Azure

Proofroom reads Azure with an app registration (a service principal) that has read-only roles, and files three kinds of evidence per run across the subscriptions you choose. Add it on Integrations → Catalogue → Azure → Connect.

What each collector shows

Collector	Kind	Default cadence	What it shows	Suggested controls
Who has access	snapshot	quarterly	Every role assignment on each subscription, its resource groups and resources, and those inherited from management groups, with the principal’s name. Owner, Contributor and User Access Administrator count as owner-level and are listed first; assignments with a condition are marked.	PCI DSS 7.2.4, 7.2.5; SOC 2 CC6.1, CC6.3
Audit logging on	snapshot	quarterly	Each subscription’s Activity Log diagnostic settings: the categories exported, the destination, and for a Log Analytics workspace how many days the AzureActivity table keeps them. A subscription with no setting that exports the Administrative category, and retention under a year, are counted. A setting that uses the `allLogs` category group counts as exporting every category (shown “via allLogs”); other category groups, such as `audit`, are not counted because Microsoft does not say which Activity Log categories they cover.	PCI DSS 10.2.1, 10.5.1; SOC 2 CC7.2
Security findings	snapshot	monthly	Microsoft Defender for Cloud recommendations that are unhealthy, with their severity and resource, and active security alerts. A subscription where Defender for Cloud returns nothing is named.	PCI DSS 6.3.1, 11.3.1; SOC 2 CC7.1

Proofroom keeps names, roles, scopes, dates and statuses only.

Create the app registration

In the Microsoft Entra admin center, go to Entra ID → App registrations → New registration. Name it “Proofroom”, leave the other options, and register it. Note the Application (client) ID and Directory (tenant) ID.
On the app, go to Certificates & secrets → Client secrets → New client secret. Copy the secret’s Value now; it is shown once. Note when it expires and renew it before then.
In the Azure portal, open each subscription Proofroom should read (or a management group above them) → Access control (IAM) → Add role assignment, and assign the app two roles:
- Reader: role assignments and diagnostic settings.
- Security Reader: Defender for Cloud recommendations and alerts.
Optional, for principal names: on the app, go to API permissions → Add a permission → Microsoft Graph → Application permissions → Directory.Read.All, then Grant admin consent for your directory. Without it, the access evidence shows object IDs instead of names.

A new role assignment can take a few minutes to apply. Proofroom never writes to Azure.

Connect

Field	Value
Directory (tenant) ID	From step 1 (or a verified domain of the directory)
Application (client) ID	From step 1
Client secret	From step 2
Subscriptions	Subscription IDs, one per line; empty means every enabled subscription the app can read

Test connection signs in, lists the subscriptions the app can read, and calls role assignments, diagnostic settings and Defender for Cloud on the first one. Any area that does not answer is named with Azure’s reason, for example AuthorizationFailed.

Known limits

Activity Log sent only to a storage account or an event hub: the retention is not read, and the evidence says so.
A Log Analytics workspace the app cannot read: the retention shows as not read.
Defender for Cloud plans that are off return nothing; the evidence names the subscription.
A subscription listed in the configuration that the app cannot read fails the run, so evidence never leaves it out silently. Subscriptions that are not enabled are skipped and named.
Public Azure only; national clouds are not supported yet.

When the client secret expires

Proofroom reads when the app registration’s client secret expires and warns admins 30 and 7 days before (the integration page lists it under Credentials, named by the secret’s description and the last four characters of its key ID, for example Client secret "Proofroom" (…a1b2); never by any part of the secret). This needs the Microsoft Graph application permission Application.Read.All with admin consent. It is optional, and it is tenant-wide: it lets the app read every app registration in the tenant, not just its own. You may prefer to skip it and track the secret’s expiry date yourself. Without it, the integration page notes that the expiry could not be read, and nothing else changes.