Azure On-Boarding Process (Manual)

This guide provides step-by-step instructions on how to create an app registration in Azure and assign the necessary roles for monitoring and cost management. It covers creating the app, generating a client secret, and assigning the Cost Management Reader and Monitoring Reader roles to ensure proper access and functionality.

Steps to Create App Registration and Assign Roles in Azure

1. Log in to Azure Portal

• Go to Azure Portal.

2. Create App Registration

• Navigate to Azure Active Directory in the left-hand menu.
• Click on App registrations.
• Click New registration.
• Provide a name for the app, e.g., "Wiv".
• Under Supported account types, select the appropriate option based on your needs (e.g., single tenant or multi-tenant).
• Click Register.

3. Note Down Application (client) ID and Directory (tenant) ID

• After registration, you will be redirected to the app's overview page.
• Note down the Application (client) ID and Directory (tenant) ID; you will need these later.

4. Generate Client Secret

• In the left-hand menu, click on Certificates & secrets.
• Click New client secret.
• Provide a description and select an expiration period.
• Click Add.
• Important: Note down the client secret value immediately as it will be shown only once.

5. Assign Roles to the App

• Navigate to Subscriptions in the left-hand menu.
• Select your subscription.
• Click on Access control (IAM).

To assign Cost Management Reader Role:

• Click Add > Add role assignment.
• In the Role tab, search for and select Cost Management Reader.
• Click Next.
• Select User, group, or service principal.
• Click + Select members.
• Search for your app registration by name and select it.
• Click Select.
• Click Review + assign.

To assign Monitoring Reader Role:

• Click Add > Add role assignment again.
• In the Role tab, search for and select Monitoring Reader.
• Click Next.
• Select User, group, or service principal.
• Click + Select members.
• Search for your app registration by name and select it.
• Click Select.
• Click Review + assign.

6. Verify Role Assignments

• Stay in the subscription's Access control (IAM) section.
• Click on the Role assignments tab.
• Filter by your app name to confirm both roles are assigned correctly.

7. Configure API Permissions (Optional)

• Navigate back to Azure Active Directory > App registrations.
• Select your app.
• Go to API permissions in the left-hand menu.
• Add any additional API permissions required for your monitoring solution (if needed).
• Note: Role assignments (RBAC) do not appear here; they are managed through IAM.

Important Notes

• Keep the client secret secure and store it in a safe location.
• The client secret has an expiration date; plan for rotation before it expires.
• Role assignments may take a few minutes to propagate across Azure services.
• Ensure you have the necessary permissions to create app registrations and assign roles in your Azure subscription.