Skip to main content

Grant Root Management Group Permissions

note

This guide is to be performed once per Azure Tenant.
The guide assumes that you have already created an Azure App Registration in your Azure Tenant.
If you haven't created an App Registration yet, please follow the Create a New Azure App Registration guide.

info

This guide assumes that you have Azure Management Groups enabled in your Azure Tenant.
If you do not have Azure Management Groups enabled, you can follow the link to Learn about Azure Management Groups.

This guide will walk you through the process of assigning the App Registration permissions at the root management group level.
Assigning the permissions at the root management group level will cascade the permissions to all the Azure Subscriptions under the root management group, giving Chronom the ability to automatically discover and scan all the Azure Subscriptions under the root management group.

Prerequisites​

In order to grant the App Registration permissions at the root management group level, you need to have:

  • At least one Active Azure Subscription.
  • An Azure App Registration with a client secret. Create a New Azure App Registration
  • Azure Management Groups enabled in your Azure Tenant.
  • The ability to create a custom role at the root management group level.
  • The ability to assign the custom role to the App Registration.
    (In order to gain the ability to create custom roles, you need to elevate your Entra ID Permissions to the User Access Administrator role by following this guide)

Instructions​

If you want to grant Chronom the ability to perform a more in-depth scan of your Azure Subscriptions, you can create a custom role with the necessary permissions.

To create a custom role, follow these steps:

  1. Download the Chronom Custom Role JSON file by clicking here and saving it to your computer.

  2. Open the Azure Portal Management Groups.

  3. Select the Tenant Root Group from the list of management groups.
    (Alternatively, you can select any other management group that you want to assign the custom role to, but this guide assumes that you are assigning the custom role at the root management group level.)

    Select Tenant Root Group

  4. Click on the Access control (IAM) tab.

    Access Control (IAM)

  5. Click on the + Add button and select Add custom role.

    Add Custom Role

  6. Fill in the following details:

    • Baseline Permissions: Start from JSON
    • Upload the JSON file you downloaded in step 1.
    • Click on the Next button.

    Create Custom Role

  7. Review the permissions and click on the Next button.
    If the permissions are too broad, you can remove the problematic permissions by clicking on the 🗑️ icon.
    (Any of the permissions can be removed except for the */read permissions.)
    In addition, you can exclude specific actions by clicking on the + Exclude permissions button.

  8. Under Assignable scopes click Add assignable scopes, make sure the type is set to Management Group, and select the Tenant Root Group.
    Click on the Select button then click Next.

    Add Assignable Scopes

  9. Review the role JSON and click on the Review + create button. If you prefer, you can modify the role permissions by clicking on the Edit button.
    (any of the permissions can be removed except for the */read permissions.)

  10. Review the role details and click on the Create button once you are ready.

Grant Permissions to the App Registration​

To grant permissions to the App Registration, Follow these steps:

  1. Open the Azure Portal Management Groups.

  2. Select the Tenant Root Group from the list of management groups.
    (Alternatively, you can select any other management group that you want to assign the custom role to, but this guide assumes that you are assigning the custom role at the root management group level.)

    Select Tenant Root Group

  3. Click on the Access control (IAM) tab.

    Access Control (IAM)

  4. Click on the + Add button and select Add role assignment.

    Add Role Assignment

  5. Search for the Role that will be assigned to the App Registration.
    If you created a custom role in the previous stage, search for the role name you created (Most likely Chronom Reader), otherwise, search for the Reader role.
    Select the role and click on the Next button.

    Select Role

  6. Click on the + Select members and search for Chronom Read-Only App Registration (or the name you gave to the App Registration).
    Select the App Registration and click on the Select button then click Next.

    Select Members

  7. Click on the Review + assign button.

  8. Once the role assignment is created, you can go back to Chronom and click on the Save button to complete the process.