Automated Azure Asset Detection Feature Guide

Important:

The Automated Azure Asset Detection feature is available for customers with solution packaging.

Introduction

The Data Mapping Discovery Automation feature from OneTrust allows you to sync with external systems with secure credentials to seamlessly generate records in your data map without extensive, technical setup. This promotes easier monitoring of assets to maintain up-to-date inventories, which improves visibility and reduces manual configuration fatigue.

This article covers how to set up an automation for Azure assets with essential information on the resource structure, naming convention, and credential configuration.

For additional information on how to manage automation details post setup, see Data Mapping Discovery Automation Overview. For guidance on reviewing pending assets, Inventory Review & Automation Feature Guide.

Discoverable Resources

OneTrust creates the Azure asset differently depending on the resource type:

  • Postgres: Create one asset per server found

  • Microsoft SQL: Create one asset per database found in each server

  • CosmosDB: create one asset per database account found

Azure Resource Organization

All Azure resource types have a scope that defines the level of that resource. Also, a resource must have a unique name within its scope. For more details, see Azure's Naming Convention.

  • Subscriptions: a purchased agreement to use Microsoft cloud platforms or services.

    • Resource Group: a management container that holds related resources for an Azure solution.

      • Resources: an entity to manage items like virtual machines, storage accounts and more in Azure.

Azure Permissions

The Service Principal must have Read permission on all Subscriptions. OneTrust will only be able to discover subscriptions if the given Service Principal has granted access. For more information, see Azure's Service Principal Object and servicePrincipal resource type guides.

To set up automation

  1. On the Data Mapping Automation menu, select Inventory > Assets. The Assets screen appears.

  2. Click the Manage automation button. The Automations screen appears.


  3. Click the Set up automation button. The Set up automation modal appears.


  4. Select Assets for the configuration, then click the Next button.


  5. Select the Azure tile.


  6. The modal will update with automatically generated details for this new automation.

    • The automation name defaults to "azure_" with a random, system-generated alphanumeric ID. Example: azure_ZMX3BiZ.

    • Scanned assets will observe the following naming convention: {resource-name}_{resource-type}_{resource-group}_{subscription}

      Example: onetrust_AzureCosmos_onetrusttest_Microsoft TBL Subscription

    • Concerning Microsoft SQL: Each SQL Server can have many databases with same name. In this case, the asset name will combine the Server Name and Database Name.

      Example: app-cm-332e41-westcentralus-att_ZenDb

      Note:

      For more information, see Azure's naming rules and restrictions for resources.



    Note:

    The automation details are set to default and you can modify them later in the automation page. These can be modified post-setup. The automation will run upon creation.

  7. Select existing credentials from prior automations or create new credentials.


    Creating new credentials requires that you provide the Client ID, Client Secret, and Tenant ID from your desired subscription.



  8. When finished, click the Create automation button. The automation will be executed and you will be navigated back to the Automations list screen.


    Tip:

    If an error message is shown for automation failure, check your credentials.



  9. Your automation is now running and ready to populate your data map. The next sync will occur one month from the creation date. For additional information on how to manage automation details post setup, see Data Mapping Discovery Automation Overview.