The Azure App that was created must be given access permissions to the following Azure APIs:
- Microsoft Graph
- Azure Storage
- Azure Key Vault
- Windows Azure Active Directory
To grant the access permissions to the Azure APIs to the Azure App:
In the left panel, select Azure Active Directory.
Select App registrations.
From the App registrations panel, select the Lacework SA Audit App created in the previous section.
Click API permissions and Add a permission.
- In the Request API permissions panel, select the Microsoft Graph tile.
In the Request API permissions panel, click the Application permissions tile.
In the Request API permissions panel, scroll down and expand User.
Click the User.Read.All checkbox.
In the Request API permissions panel, scroll down and expand Directory.
Click the Directory.Read.All checkbox and Add permissions.
Click Add a permission.
- In the Request API permissions panel, select the Azure Key Vault tile. NOTE: To see Azure Key Vault listed, the Microsoft.KeyVault provider may need to be registered as described in a previous step.
In the Request API permissions panel, click the Delegated permissions tile, the user_impersonation - Have Full Access to the Azure Key Vault service checkbox, and Add permissions.
Click Add a permission.
- In the Request API permissions panel, select Azure Storage. You may have to select the APIs my organization uses tab to find Azure Storage. NOTE: To see Azure Storage listed, the Microsoft.Storage provider may need to be registered as described in a previous step.
- In the Request API permissions panel, click the Delegated permissions tile, the user_impersonation Access Azure Storage checkbox, and Add permissions.
- Click Grant admin consent for YourDirectory and Yes.
You should see the following permissions.
