Skip to main content

Introduction

In order to scan your Azure resources, Chronom uses an Azure App Registration to authenticate with your Azure Tenant and scan the resources in your Azure Subscriptions.

The App Registration is created in your Microsoft Entra ID tenant and assigned read-only permissions to your Azure subscriptions.

Note that while the App Registration is created in your tenant, the custom role is created in the subscription you want to scan.
By design, the App Registration has read-only permissions only to the subscription you want to scan, and it does not have access to any other resources in your tenant nor does it have the ability to modify any resources.

High-Level Overview​

This guide will walk you through the process of adding your Azure Subscriptions to Chronom.

The process consists of the following steps:

  1. Create a New Azure App Registration in your Azure Tenant.
    This App Registration will be used by Chronom to authenticate with your Azure Tenant and scan your Azure Subscriptions, therefore it only needs to be created once per tenant.

  2. Grant the App Registration Permissions to Read Your Azure Subscriptions.
    This step can be done in two ways:

    1. Recommended - Grant the App Registration Permissions at the Root Management Group Level.
      This step involves creating a custom role at the root management group level and assigning it to the App Registration. (This method requires Azure Management Groups to be enabled in your Azure Tenant)

    2. Grant the App Registration Permissions to Read Your Azure Subscriptions.
      This step involves creating a custom role in each of your Azure Subscriptions and assigning it to the App Registration.

Prerequisites​

note

If you have Conditional Access Policies enabled, you need to ensure that the App Registration can bypass the policies.
(Please contact our support for more information)

In order to add your Azure subscriptions to Chronom, you need to have the following:

Chronom's App Registration Subscription Level Permissions​

For Chronom to scan your Azure resources, the App Registration needs to have the necessary permissions to read the resources in your Azure Subscriptions.

Detailed below are the permissions that should be assigned to the App Registration.

In addition to the baseline permissions, you can optionally grant the App Registration additional permissions to allow for a more comprehensive and detailed scan of your Azure resources.

The App Registration must be assigned at least with the Reader Role in the subscription you want to scan.
The Reader Role has the following permissions:

{
    "id": "/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
    "properties": {
        "roleName": "Reader",
        "description": "View all resources, but does not allow you to make any changes.",
        "assignableScopes": [
            "/"
        ],
        "permissions": [
            {
                "actions": [
                    "*/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

Granting Chronom's App Registration the Reader Role will allow you to have the basic level of scanning capabilities.

In addition, Assigning the Reservation Reader role to the Chronom Read-Only App Registration grants read-only access to reservation metadata and utilization metrics required for Chronom’s cost-optimization insights, without any modify or purchase permissions.

{
    "id": "/providers/Microsoft.Authorization/roleDefinitions/582fc458-8989-419f-a480-75249bc5db7e",
    "properties": {
        "roleName": "Reservations Reader",
        "description": "Lets one read all the reservations in a tenant",
        "assignableScopes": [
            "/providers/Microsoft.Capacity"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Capacity/*/read",
                    "Microsoft.Authorization/roleAssignments/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}