Connect Microsoft Azure

A Microsoft Entra application with the Reader role at subscription scope — read-only visibility, no modify permissions.

1. 1Before you begin. These instructions use a Microsoft Entra application with the Reader role at the Azure subscription level. Reader provides management-plane visibility into Azure resources without permission to modify them. Sign in to the Azure portal with an account that can: • Register Microsoft Entra applications. • Assign Azure roles on the subscription. To assign the Reader role, your account normally needs Owner, User Access Administrator, or Role Based Access Control Administrator at the subscription scope. You will collect these four values — Tenant ID = Directory (tenant) ID Client ID = Application (client) ID Client secret = Client secret Value Subscription ID = Azure Subscription ID
2. 2Verify the correct Azure tenant. 1. Sign in to the Azure portal. 2. Select your profile icon in the upper-right corner. 3. Select Switch directory or Directories + subscriptions. 4. Confirm that you are working in the tenant containing the Azure subscription you want Cybermatic to scan. 5. Select Switch if necessary. The app registration and subscription must belong to the same Microsoft Entra tenant unless you are intentionally configuring a multitenant application.
3. 3Create the Cybermatic app registration. 1. Use the search bar at the top of the Azure portal. 2. Search for: Microsoft Entra ID 3. Open Microsoft Entra ID. 4. In the left menu, select: App registrations 5. Select: New registration 6. Enter the following information — Name: Cybermatic Scanner Supported account types: select “Single Tenant Only – Default Directory”. This creates a single-tenant application for your organization. Redirect URI: leave this blank. A background scanner using application credentials does not require an interactive sign-in redirect URI. 7. Select Register. Azure creates an application registration and its corresponding service principal in your tenant.
4. 4Copy the tenant ID and client ID. After registration, Azure opens the app’s Overview page. Locate the Essentials section and copy these two values: 1. Application (client) ID 2. Directory (tenant) ID Record them securely, for example — Tenant ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Client ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Do not copy the Object ID. Cybermatic needs the Application (client) ID, not the Object ID. Microsoft identifies the Application ID and Directory ID on the app registration’s Overview page.
5. 5Create the client secret. 1. While still inside the Cybermatic Scanner app registration, select: Certificates & secrets 2. Under Client secrets, select: New client secret 3. Enter a description such as: Cybermatic Scanner connection 4. Under Expires, choose 730 days (24 months). A practical choice is 24 months, provided you create a reminder to rotate the secret before it expires. 5. Select Add. 6. Azure displays the new client secret. 7. Immediately copy the entire value from the Value column. The value will look similar to: AbC8Q~example-secret-value-123456 Critical distinction — Copy: Value. Do not copy: Secret ID. The client secret Value is displayed only when it is first created. If you leave the page without copying it, delete that secret and create another one. Store the value securely and record its expiration date.
6. 6Find your Azure Subscription ID. 1. Use the Azure portal search bar. 2. Search for: Subscriptions 3. Open Subscriptions. 4. Select the subscription you want Cybermatic to scan. 5. On the subscription’s Overview page, locate: Subscription ID 6. Copy the full ID. It will use this format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Make sure you copy the ID from the subscription containing the storage accounts, virtual machines, network security groups, SQL resources, and other assets Cybermatic should scan.
7. 7Assign the Reader role. Remain on the Azure subscription you selected. 1. In the subscription menu, select: Access control (IAM) 2. Select: Add 3. Select: Add role assignment Role tab — 4. In the role list, search for: Reader 5. Select the built-in Reader role. 6. Select Next. Do not select: Reader and Data Access, Security Reader, Directory Readers, or Billing Reader. For this connection, you want the standard Azure RBAC role named exactly: Reader Members tab — 7. For Assign access to, select: User, group, or service principal 8. Select: Select members 9. Search for: Cybermatic Scanner 10. Select the Cybermatic Scanner application. 11. Select Select. 12. Select Next. Conditions and assignment type — 13. If Azure shows a Conditions tab, leave the default setting with no condition. 14. If Azure asks for an assignment type, choose an active assignment unless your organization specifically requires Privileged Identity Management. 15. Select Review + assign. 16. Review the information. 17. Select Review + assign again. Azure RBAC role assignments consist of a security principal, a role and a scope. Assigning Reader at the subscription scope gives the service principal read visibility across resources in that subscription.
8. 8Enter the values in Cybermatic. Sign in to Cybermatic. 1. Open: Connections 2. Under: Connect a cloud or SaaS account 3. Select: Microsoft Azure 4. Enter the four values — Tenant ID: paste the Azure Directory (tenant) ID. Client ID: paste the Azure Application (client) ID. Client secret: paste the client secret Value. Subscription ID: paste the Azure Subscription ID. 5. Check that there are no spaces before or after the values. 6. Select Connect Azure. Example mapping — Tenant ID = Directory (tenant) ID Client ID = Application (client) ID Client secret = Client secret Value Subscription ID = Subscription ID Cybermatic should authenticate as the service principal and start the initial scan.
9. 9Troubleshooting. “Invalid client secret” or AADSTS7000215 — most commonly, the Secret ID was pasted instead of the secret Value. Create a new secret and immediately copy its Value. Also check for: extra spaces, an expired secret, or a secret from a different app registration. “Application not found” or AADSTS700016 — verify that: the Client ID is the Application (client) ID; the Tenant ID is the Directory (tenant) ID; both values came from the same Cybermatic Scanner app; and you registered the app in the tenant associated with the subscription. AuthorizationFailed or HTTP 403 — verify Subscription → Access control (IAM) → Role assignments. The Cybermatic Scanner service principal must have Role: Reader at Scope: Subscription. A Reader role assigned only to one resource group will not expose resources outside that resource group. Cybermatic Scanner does not appear under Select members — confirm the app registration exists; wait briefly and refresh the role-assignment page; search using the application’s exact name; search using the Application Client ID if the portal supports it; confirm that you are in the correct Microsoft Entra directory. “Add role assignment” is disabled — your account does not have sufficient Azure RBAC privileges at that subscription. Use an account with Owner, User Access Administrator, or Role Based Access Control Administrator. Multiple Azure subscriptions — assign the Reader role to Cybermatic Scanner separately on every subscription that should be scanned. The role does not automatically cross subscription boundaries. Add each subscription as its own connection using its individual Subscription ID.
10. 10Client-secret security. Microsoft recommends certificates, managed identities or federated credentials over client secrets for production applications because secrets can be copied or exposed. Since this Cybermatic connector currently requires a secret, use the shortest practical expiration period, store it securely and rotate it before it expires. The connection can remain permanently configured, but the client secret itself is not permanent. When rotating it, create the replacement first, update Cybermatic and then delete the old secret after confirming the connection works.

Tip: The two classic first-connection failures are pasting the Secret ID instead of the secret Value, and assigning Reader on a resource group instead of the subscription — the troubleshooting step covers both.