Integrating with Azure to Collect Evidence

You can set up Azure collectors to automatically collect evidence. Adding a collector will connect Azure with an evidence task so that evidence collection can begin. For information on managing your collector, see Managing Collectors .

This article covers the third-party systems listed below:

  • Azure Blob Storage

  • Azure Cosmos

  • Azure Disks

  • Azure Firewalls

  • Azure Function App

  • Azure IAM

  • Azure Monitor

  • Azure Network Security Groups

  • Azure SQL Server

To set up and activate collectors

Collectors are integrations that are set up to pull evidence from third-party systems. To integrate OneTrust with a third-party system, you must set up the credentials that OneTrust will use to connect to the system. You have the ability to create a new credential when setting up the collector.

Important:

If you plan to set up and activate the collector using a new credential, start with the Access Requirements section.

  1. On the Compliance Automation menu, select Setup > Evidence Integrations.
    The Evidence Integrations screen appears.

  2. Click on the Azure system that will be set up to collect evidence.
    The Integration Details screen appears.
    Note:

    You can select any of the Azure integrations.

  3. Click the Add Collector button.
    The Set Up Collector modal appears.
    Note:

    The collectors shown within this modal are unique to the services available for each third party system.



  4. Select the service that will collect evidence and click the Continue button.
  5. Complete the fields in the Add Details tab. For more information, see Add Details Screen Reference .
  6. Click the Continue button.
  7. Complete the fields in the Define Evidence Collection tab. For more information, see Define Evidence Collection Screen Reference.
  8. Click the Continue button.
  9. Review the information for the collector.

    Click the Previous button to edit the evidence collection details.

  10. Click the Activate Collector button to save and activate the collector. The collector's status will appear on the Integration Details screen. For information on managing your collector, see Managing Collectors .
    Note:

    This is the only location where you can activate the collector. This is to ensure the collector is not activated by mistake.



    Click the Cancel button to save the collector without activating it.

Add Details Screen Reference



Step

Field

Description

Add Details

Collector Name

Enter a unique and descriptive name for the collector that will be used to create the integration. This name will help you identify the collector in future interactions.

Note:

Once you advance to the next screen, you cannot change the collector name.

Collector Assignee Email

Enter the email address that will receive notifications related to this collector. Create a distribution list if you would like to notify multiple users.

Email notifications are sent in the following situations:

  • The collector has been assigned to you and activated.

  • Evidence has been successfully captured.

  • Errors were found while capturing evidence automatically.

Choose Credentials

Select Credential

Select the existing credential you would like to use to share data securely. The collector will use credentials to access and gather data from the desired source.

You can create a new credential by clicking the Add new credential option. The Add new credential modal will appear.

Note:

You can also create a new credential in the Integrations menu. Once the new credential is created, it will appear as a saved credential. For more information, see Configuring Integration Credentials.

Credential Name

Enter a name to identify the credentials.

Note:

This field and all fields below only appear when you select the Add new credential option.

Description

Enter a description of the credentials.

Client ID

Enter the Client ID. To locate the Client ID, see Access Requirements.

Client secret

Enter the Client secret. To locate your client secret, see Access Requirements.

Tenant ID

Enter the Tenant ID. To locate your tenant ID, see Access Requirements.

Save Credential

Click the Save Credential button to create and save the new credential

Note:

If the credential is unable to collect evidence, you will need to select or create another credential.

Test Credential

Click the Test Credential button to test the credentials ability to collect evidence.

Define Evidence Collection Screen Reference



Step

Field

Description

Choose Evidence Tasks

Evidence Task List

Select one or more evidence tasks for this collector. You can filter the evidence tasks list by recommended, all evidence tasks, and selected tasks.

Assign Collection Intervals

Collection Interval

Select a collection interval to determine how often this collector will sync and collect evidence. The collection interval will apply to all selected evidence tasks.

Tip:

OneTrust recommends you choose the most frequent option.

For example, if the evidence tasks you selected have a frequency of Monthly, Quarterly, and Yearly - you should choose Monthly for your collection interval.

Time of Day

Select the time of day that evidence will be collected. All times are in UTC.

Day of the Week

Select the day of the week that evidence will be collected.

Note:

This option only appears if the Weekly collection interval is selected.

Day of the Month

Select the day of the month that evidence will be collected.

Note:

This option only appears if the Monthly, Quarterly, or Biannually collection interval is selected.

Interval Start Month

Select the month when evidence will start being collected. This will set the cadence of evidence collection.

Note:

This option only appears if the Quarterly or Biannually collection interval is selected.

Date and Time of Day

Select the date and time that evidence will be collected. All times are in UTC.

Note:

This option only appears if the Yearly collection interval is selected.

Access Requirements

Evidence can be collected from select Azure subscriptions or select Azure resource groups by creating a new service principal in Azure Active Directory.

To Register an Application

To create a service principal, you must first register an application in the Azure Active Directory.

Note:

If you’ve already registered an application during the Microsoft Azure Active Directory (AD) integration setup or the Microsoft Intune integration setup, please proceed to the To Add API Permissions to the Registered Application section.

  1. Login to access the Azure Homepage.



  2. Open Azure Active Directory through one of the following options. The Overview screen appears.

    • Enter Azure Active Directory in the Search field and select it.

    • Select Azure Active Directory from the Azure services menu, if available.

  3. Select App registrations on the left-hand navigation menu. The App Registrations screen appears.



  4. Click + New registration. The Register an application screen appears.



  5. Enter OT Evidence Collection in the Name field.

  6. Select the Accounts in this organizational directory only ([Default Directory] only - Single tenant) option in the Supported account types section.

  7. Click the Register button. The Overview screen appears.



  8. Copy the Application (client) ID and the Directory (tenant) ID for later use.

    Note:

    These IDs are required to configure the platform to connect to your Azure account.

To Add API Permissions to the Registered Application

  1. Select API permissions on the left-hand navigation menu. The API permissions screen appears.



  2. Click + Add a permission. The Request API permissions pane appears.



  3. Click Microsoft Graph.

  4. Select the Application permissions option.

  5. Enter AuditLog.Read.All in the Search field.

  6. Click the Arrow icon next to AuditLog.

  7. Click the checkbox next to AuditLog.Read.All.



  8. Click the Add Permission button.

  9. Click + Add a permission. The Request API permissions pane appears.

  10. Click Microsoft Graph.

  11. Select the Application permissions option.

  12. Enter Directory.Read.All in the Search field.

  13. Click the Arrow icon next to Directory.

  14. Click the checkbox next to Directory.Read.All.

    Note:

    If this permission has already been selected due to the Microsoft Azure AD integration setup, please proceed to step 16.

  15. Click the Add Permission button.

  16. Click Grant admin consent for [Default Directory].



  17. Click Grant admin consent for [Default Directory]. The Grant admin consent confirmation modal appears.

  18. Click the Yes button.

To Create a Client Secret for the Registered Application

  1. Select Certificates & secrets on the left-hand navigation menu. The Certificates & secrets screen appears.



  2. Click + New client secret. The Add a client secret pane appears.



  3. Enter a description of the client secret in the Description field.

  4. Select the duration of the client secret in the Expires field.

  5. Click the Add button to save the new client secret.

  6. Copy the Value field for later use by using the Copy to Clipboard icon.



    Note:

    The value is required to configure the platform to connect to your Azure account. You cannot retrieve the value after you leave this screen.

To Grant Access to an Azure Service Principal

Note:

You can limit the platform’s access in any Azure environment through Azure Active Directory Role-Based Access Control (RBAC).

  1. Navigate to the Azure Homepage.

  2. Type subscriptions in the Search field.

  3. Select Subscriptions under the Services section. The Subscriptions screen appears.



  4. Click the applicable subscription name to assign the application.

  5. On the Subscription menu, select Access Control (IAM). The Access Control (IAM) screen appears.



  6. Click + Add and select Add Role Assignment. The Add role assignment screen appears.



  7. Enter Reader in the Search field.

  8. Select Reader and then click the Next button.

  9. Select User, group, or service principle.

  10. Click + Select Members. The Select members pane appears.



  11. Select the app registration.

  12. Click the Select button.

  13. Click the Next button. The Review + assign tab appears.



  14. Click the Review + assign button.