Onboard Azure Servers : InfraGuard

Get account information from Azure's portal

Log in to your Azure account
Search "Azure Active Directory" from the top search text box and select it
Copy the tenant id and keep it in a safe place. We will need it while adding information on InfraGuard
On the side menu of the same page click on "App registrations" and select "New registration"
Enter the name as Infraguard app
Make sure "Single Tenent" is selected in Supported Account types
In Redirect URI select "Web" from the list and enter https://app.infraguard.io in the text box next to it
Click on Register
Now your application is registered. Copy the "Application (Client) ID" and keep it in a safe place
Go to "Certificates and Secrets" from the left menu and click on the "New Client Secret" button
Enter description as Infraguard key and select "24 months" in the "EXPIRES" option radio button
Click on Add
This will generate a new client secret key. Copy the value column item and keep it in a safe place with the name Client Secret
Now search "Subscription" on the top search text box and go to your current subscription and copy the subscription id and put it in a safe place
Select "Access control(IAM)" from the menu of your subscription and click on "+Add" and select custom role
Enter your custom role name as "InfraGuard-role"
Select JSON click on edit and insert the following:

{
    "properties": {
        "roleName": "InfraGuard-role",
        "description": "",
        "assignableScopes": [
            "/subscriptions/<INSERT YOUR SUBSCRIPTION ID>"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Compute/snapshots/delete",
                    "Microsoft.Compute/snapshots/read",
                    "Microsoft.Compute/snapshots/write",
                    "Microsoft.Compute/virtualMachines/instanceView/read",
                    "Microsoft.Compute/virtualMachines/read",
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                    "Microsoft.Network/networkInterfaces/read",
                    "Microsoft.Network/publicIPAddresses/read",
                    "Microsoft.Compute/virtualMachines/start/action",
                    "Microsoft.Compute/virtualMachines/restart/action",
                    "Microsoft.Compute/virtualMachines/deallocate/action",
                    "Microsoft.Compute/virtualMachines/runCommands/write",
                    "Microsoft.Compute/virtualMachines/runCommands/read",
                    "Microsoft.Compute/virtualMachines/runCommand/action",
                    "Microsoft.Compute/virtualMachines/assessPatches/action",
                    "Microsoft.Compute/virtualMachines/installPatches/action"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

Replace <INSERT YOUR SUBSCRIPTION ID> with your subscription id in the 6th line and click on Save
Then select "Review + Create" and then Create. The role is created. Click OK to return to the IAM role page
Click on the "add a role assignment" button on the card "Grant access to this resource" on right
Now select the "Role" tab and search for "InfraGuard-role". Select this role and click Next
In the Member tab click on "+Select Member" and search for "Infraguard app" on the right side below Select Members
Select Infraguard app and click on select. Then click on "Review and Assign"

Additional Steps if you want to use Azure Advanced Patch Management

After following the above steps, go to "Subscription"
Select "Access control(IAM)" from the menu of your subscription select Roles and search and edit "InfraGuard-role"
Select JSON click on edit and insert the following permissions:

"Microsoft.Compute/virtualMachines/write",
"Microsoft.Automation/automationAccounts/read",
"Microsoft.Automation/automationAccounts/write",
"Microsoft.Automation/automationAccounts/delete",
"Microsoft.Automation/automationAccounts/schedules/write",
"Microsoft.Automation/automationAccounts/schedules/read",
"Microsoft.Automation/automationAccounts/schedules/delete",
"Microsoft.Automation/automationAccounts/softwareUpdateConfigurations/write",
"Microsoft.Automation/automationAccounts/softwareUpdateConfigurations/read",
"Microsoft.Automation/automationAccounts/softwareUpdateConfigurations/delete",
"Microsoft.Automation/automationAccounts/softwareUpdateConfigurationRuns/read",
"Microsoft.Automation/automationAccounts/linkedWorkspace/read",
"Microsoft.OperationalInsights/workspaces/read",
"Microsoft.OperationalInsights/workspaces/analytics/query/action",
"Microsoft.OperationalInsights/workspaces/query/*/read"

Now click on "Review + update" then update
Now search for the Automation Accounts
Click on the "+Create"
Select the resource group
Enter the automation account name as "infraguard-automation"
Click on the "Review + Create" button then create
Click on the automation account(infraguard-automation)
Click on the Access Control(IAM)
Click on the "add a role assignment" button
Now select the "Role" tab and search for "InfraGuard-role". Select this role and click Next
In the Member tab click on "+Select Member" and search for "infraguard" on the right side below Select Members
Select Infraguard app and infraguard-automation and click on select. Then click on "Review and Assign"
Click on the Update management and select the "Create New Workspace" in the Log analytic workspace selection and click on Enable
Go back to Automation Accounts and select "infraguard-automation" and Click on the Update management
Click on the "+Add Azure VMs" and select VMs from the listing (Only selected machines is available for automation patching)
Search "Azure Active Directory" from the top search text box and select it
On the side menu of the same page click on "App registrations" and select the "infraguard app"
On the side menu of the same page click on "API Permissions" and click on the "+Add permission"
Select APIs my organization uses search for the "Log Analytics API"
Click on the Log Analytics API and select the Delegated permissions and check the Data.read permission
Click on the Add permission

Note: If you use Azure Advance Patch Management on servers that do not have the Log Analytics Agent installed, you will get the message "No updates found". Please only use Azure Advance Patch Management on servers that have the agent installed.

Onboard your servers to InfraGuard

Log onto app.infraguard.io Account
Select CLUSTER from side-menu
Click on “Create Azure cluster”
Add any relevant Name
Add Tenant ID, Subscription ID, Client ID, and Client Secret as created and copied in the previous section
Click ‘Sync’ to make your newly added server appear in the list of servers
Wait for some time before you click on ‘Servers’ to get your list of servers for that Role ARN

Onboard Azure Servers Print

Get account information from Azure's portal

Onboard your servers to InfraGuard

Related Articles