Manage Microsoft Azure(Non-CSP) Cloud Account

Prerequisites for onboarding Microsoft Azure (Non-CSP) Accounts

1. Ensure that Azure account is a pay-as-you-go-subscription or an EA account.

Important Note: Sponsored and CSP Offer subscription can be onboarded for Governance and Service Orchestration. However, these subscriptions are not supported for Azure Cost & Usage & Resource Management.

1. Obtain/Configure Azure Subscription Access information

   1. Obtain the Subscription ID from the Azure Active Directory

   2. Obtain the Directory ID a.k.a Tenant ID from the Azure Active Directory  Properties

   3. Register a new Application via App Registration which will create an application ID. Record the Application and Assign the following permissions :

      1. Reader (Required)

      2. Billing Reader (Required)

      3. Contributor Role (Required only for Service Orchestration)

   4. Generate a new secret for the Application and save the key value.

   5. Ensure App Registration under User Settings is set to no. If not, only Administrators may register these types of applications.

2. (Optional) HyperCloud™ periodically queries (default 90 mins) Azure account to obtain state change information. If capturing real time state change is required, then provide the Azure event hub when adding the Azure Account in HyperCloud™.

Important Note: Microsoft Azure allows only 1 active event hub at any given time. In this case, use an existing event hub but create a new Consumer Group with the name HyperGrid.
Important Note: Event hub pricing tier must be Standard pricing since only standard pricing tier allows more than 1 Consumer Group

1. 1. Create a new event hub (Skip this step if using existing event hub):

      1. From the Azure portal{*}, Home  Events Hub*  Create a new Events Hub Namespace Name

Important Note: Must Select Standard Pricing. Rest of the options can be selected as per customer's choice.

1. 1. 1. Obtain the Shared access policies (SAS) Policy Name for e.g RootManageSharedAccessKey. Enter this as the Shared Access Signature Key Name in HyperCloud™ Azure Account Configuration

      2. From the *Event Hub Namespace  Share Access Policy*  Obtain the Primary Key. Enter this as the Shared Access Signature Key in HyperCloud™ Azure Account Configuration

Important Note: An event hub with the name insights-activity-logs will get created automatically once we enable Activity Monitoring to Export diagnostic settings to Event hub and Storage account

1. 1. Use an existing event hub

      1. Using the steps from the previous step, obtain the Event Hub Namespace Name, Shared Access policy Name and Shared Access Key Name.

      2. From the Event Hub Namespace, obtain the Primary Key from the Shared access policy.

      3. Click on Event Hub for e.g. insights-activity-logs  Click on Consumer groups  Create a new Consumer group with the name HyperGrid. Enter this name in the HyperCloud™ Azure Account Configuration.

Important Note: A consumer group must be created to use existing event hub.

1. 1. Configure a new Storage Account (skip this step if using an existing storage account)

      1. From Storage Accounts  select a storage account or create a new storage account. Click on the storage account  select Access Keys  select Key 1 Connection String which will be used as the Storage Connection String.

      2. From Storage Account  create a Blob Container  Obtain the blob container name which will be used as the Storage Container Name

   2. Using an existing Storage account details

      1. From Storage Accounts  select storage account used when Exporting Activity log to Event Hub  select Access Keys  select Key 1 Connection String. Enter this in HyperCloud™ Azure Account configuration page.

      2. From Storage Account select Blob Container  Obtain the blob container name. Enter this in HyperCloud™ Azure Account configuration page.

   3. Configuring Activity Monitoring (Verify if this is already configured)

      1. From Home  Monitor -> Activity Log -> select Diagnostics Settings  Click on Add Diagnostic setting

      2. Enter a Name HyperGrid-Diagnostics

      3. Under Log  Select Administrative & Under Destination Details 

• Select Archive to a storage account and select an existing storage account.

• Select Stream to an event hub and select an existing event hub

  1. Obtain Event Hub name

     1. Return to Events Hub Namespace  locate the even hub with the name insights-activity-logs  Select Capture  Select ON  Select Capture Provider - Azure Storage  Select Storage Container and select the blob container created in the previous step  Save Changes

  2. This completes the requirements for Azure Governance and Compliance

Onboarding Microsoft Azure (Non-CSP) Account to HyperCloud™

1. Login to HyperCloud™ SaaS portal using a valid credential.

2. Under the Administration Tab  Account Management  Select Azure  Non-CSP  Add Account and populate all the fields as per the information collected in the Prerequisites for managing Microsoft Azure Accounts using HyperCloud™ Platform section.

1. This completes the steps to add an Azure EA or Pay-as-you-Go account to HyperCloud™ Platform