Configure Microsoft Azure

Create an app registration in Azure

The app registration provides trust between your app and Azure.

  1. Open a browser and sign in to the Azure portal https://portal.azure.com/#home.

  2. Navigate to Home > Azure Active Directory > App registrations.

  3. Select New registration.

    The Register an application dialog.

  4. Enter the Name, a user-facing or friendly name. Select the applicable Supported account types and enter a Redirect URI.

    For example:

    create azure app registration

  5. Select Register.

    The newly created registration appears.

    created azure app registration

  6. Select API permissions. Alternatively, select Home > Azure Active Directory > App Registrations > <Display name> > API permissions.

  7. Select Add a permission and add the following permissions:

    Microsoft API Permission Type

    Microsoft Graph

    Application.ReadWrite.All

    Application

    Microsoft Graph

    User.Read (granted by default)

    Delegated

    Azure Key Vault

    user_impersonation

    Delegated

    Azure Service Management

    user_impersonation

    Delegated

    For example:

    azure keyvault permission

For additional information, see Creating a Service Principal.

Add the app to the subscription Reader Role list

The Owner permission of the subscription is required to perform this operation.

  1. Navigate to Home > Subscriptions.

  2. Select your subscription.

  3. Select Access control (IAM).

  4. Select Add and then select Add role assignment from the pull-down menu.

    subscription reader role 1

  5. In the Add role assignment dialog, select the Reader role and then select the Members tab.

    subscription reader role 2

  6. Select Select members, search for the app Display name, and select it.

  7. Select Save.

    subscription reader role 3

    The new subscription Reader role is added.

    subscription reader role 4

Create an Azure key vault

An existing Azure key vault with Permission model equals Vault access policy can be used for this integration. A new Azure key vault was created in this integration to show the entire process.

For an existing Azure key vault, proceed to section Add the app registration to the key vault access policies directly, skipping this section entirely.

  1. Open a browser and sign in to the Azure portal https://portal.azure.com/#home.

  2. In the home page, select the Create a resource icon.

  3. Select Key Vault.

    The Create a key vault dialog appears.

  4. In the Basics tab select the Subscription and Resource group from the pull-down menu. Enter the instance details.

  5. Select Next.

    For example:

    create azure keyvault 1

  6. In the Access configuration tab, select the Permission model, Resource access, and Access policies.

  7. If you are using Vault access policy for the Permission model:

    1. Select the user.

    2. Select Edit and select all permissions that apply.

    3. Select Save and Next.

    All Key Permissions, Secrets Permissions, and Certificate Permissions were selected for the purpose of this integration.

    create azure keyvault 2

  8. In the Networking tab, select Enable public access.

  9. Under Public access, select All networks.

  10. Select Next.

    create azure keyvault 3
    create azure keyvault 4

  11. In the Tags tab enter the required Name and Value. These were left blank for the purpose of this integration.

  12. Select Next.

  13. Review the information and select Create.

    create azure keyvault 5

  14. A deployment page appears. The newly created Azure vault is included.

    create azure keyvault 6

Add the app registration to the key vault access policies

These steps configure the key vault policies to allow access by the app.

  1. Navigate to Home > Key vault > <Key_vault_name> > Access policies.

  2. Select Create.

    The Create and access policy dialog appears.

  3. In the Permissions tab select the following Key permissions.

    Key permissions Selection

    Key Management Operations

    All

    Privileged Key Operations

    All

    Rotation Policy Operations

    All

  4. Select Next.

  5. In the Principal tab, enter the Display name of the app. After the app is found, select the app.

  6. Select Next.

    For example:

    add app reg to vault access policy 1

  7. Select Next in the Application (optional) tab.

  8. Review the information and select Create.

    For example:

    add app reg to vault access policy 2

  9. The Access policies page appears. The new vault access policy is included.

    add app reg to vault access policy 3

For additional information, see Set Permissions for the BYOK Service by Configuring Each Azure Key Vault.