Microsoft Azure Identity
Microsoft Azure- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Azure Identity connector integrates with Microsoft Azure and synchronizes the identity and role-based access control (RBAC) resources that determine what a compromised workload can reach, using the Azure Resource Manager APIs (via the Azure SDK for Java). For each configured subscription it lists user-assigned managed identities, role assignments, and role definitions, and maps each to a Cloud Resource connector object.
Together these three objects reconstruct the RBAC chain: a role assignment binds a principal — a managed identity, user, group, or service principal — to a role definition at a scope. Resolving the assignment's ROLE_DEFINITION_ID to a role definition yields the concrete control-plane and data-plane actions that principal may perform, and SCOPE bounds where. Joining the assignment's PRINCIPAL_ID back to a workload's managed identity answers the blast-radius question directly: if this virtual machine or cluster were compromised, what could the attacker do?
When no subscription is configured the connector enumerates every subscription accessible to the configured Azure AD application; otherwise it processes only the comma-separated subscriptions provided. Subscriptions are processed in parallel, and a subscription the service principal cannot read is logged and skipped rather than failing the whole sync.
Data retrieved from Microsoft Azure Identity
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| User Assigned Identity | Yes | Cloud Resource |
| Role Assignment | Yes | Cloud Resource |
| Role Definition | Yes | Cloud Resource |
Model relationships
For detailed steps on how to view the data retrieved from Microsoft Azure Identity in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Microsoft Azure Identity from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Client ID | Yes | — | The service principal client ID. The client ID is generated during service principal registration. |
| Client secret | Yes | — | The service principal client secret or password. |
| Tenant ID | Yes | — | The tenant or domain the credential is authorized for. The tenant ID is generated during service principal registration. |
| Subscription ID | No | — | (Optional) Comma-separated list of Subscription IDs. If none is specified, the connector will automatically discover all subscriptions for the tenant. |
Authentication
Method
Azure Active Directory OAuth 2.0 Client Credentials (client ID + client secret + tenant ID), performed by the Azure SDK for Java (ClientSecretCredential) against the Azure public-cloud Active Directory endpoint.
Endpoint
| Method | URL |
|---|---|
POST | https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token |
The token request is issued internally by the Azure Identity library when an AzureResourceManager client is authenticated; the connector does not call the token endpoint directly.
Request Body (form-urlencoded)
| Parameter | Value |
|---|---|
grant_type | client_credentials |
client_id | {clientId} |
client_secret | {clientSecret} |
scope | https://management.azure.com/.default |
Sample Response
{
"token_type": "Bearer",
"expires_in": 3599,
"ext_expires_in": 3599,
"access_token": "<access_token>"
}
Response Fields
| Field | Type | Description |
|---|---|---|
token_type | String | Authorization scheme prefix (Bearer) |
expires_in | Integer | Token lifetime in seconds |
ext_expires_in | Integer | Extended token lifetime in seconds |
access_token | String | Bearer token applied to subsequent Azure Resource Manager requests |
Usage
The Azure SDK attaches the bearer token to every Azure Resource Manager request and refreshes it automatically:
Authorization: Bearer <access_token>
The credential is built once and reused per subscription, scoped via withSubscription({subscriptionId}).
Required Permissions
The built-in Reader role at subscription scope is sufficient for every object type this connector syncs — it grants Microsoft.ManagedIdentity/userAssignedIdentities/read, Microsoft.Authorization/roleAssignments/read, and Microsoft.Authorization/roleDefinitions/read. No custom role is needed, and the connector never writes to Azure.
Sync Behavior
The connector performs a full sync on every run. Azure Resource Manager does not provide an incremental change filter for managed identities or for the authorization collections, so each sync enumerates all resources of the requested type across the configured subscriptions (or all accessible subscriptions when none is configured). Incremental (delta) syncs are not supported.
How to obtain Microsoft Azure Identity credentials
Obtain the required credentials (clientId, clientSecret, tenantId) from your Microsoft Azure Identity administrator or the Microsoft Azure Identity admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
User Assigned Identity
| Source Field Name | SDM Attribute |
|---|---|
Identity.clientId | CLIENT_ID |
Identity.id | UID |
Identity.id | RESOURCE_ID |
Identity.name | NAME |
Identity.principalId | PRINCIPAL_ID |
Identity.regionName | REGION |
Identity.resourceGroupName | RESOURCE_GROUP |
Identity.tags | TAGS |
Identity.tenantId | TENANT_ID |
| Subscription being synced | SUBSCRIPTION_ID |
Role Assignment
| Source Field Name | SDM Attribute |
|---|---|
RoleAssignment.condition | CONDITION |
RoleAssignment.id | UID |
RoleAssignment.id | RESOURCE_ID |
RoleAssignment.name | NAME |
RoleAssignment.principalId | PRINCIPAL_ID |
RoleAssignment.principalType | PRINCIPAL_TYPE |
RoleAssignment.roleDefinitionId | ROLE_DEFINITION_ID |
RoleAssignment.scope | SCOPE |
| Subscription being synced | SUBSCRIPTION_ID |
Role Definition
| Source Field Name | SDM Attribute |
|---|---|
| :--- | :--- |
| List | actions |
| List | notActions |
| List | dataActions |
| List | notDataActions |
RoleDefinition.assignableScopes | ASSIGNABLE_SCOPES |
RoleDefinition.description | DESCRIPTION |
RoleDefinition.id | UID |
RoleDefinition.id | RESOURCE_ID |
RoleDefinition.name | NAME |
RoleDefinition.permissions | PERMISSIONS |
RoleDefinition.roleName | ROLE_NAME |
RoleDefinition.roleType | ROLE_TYPE |
| Subscription being synced | SUBSCRIPTION_ID |
| Type | Field |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
User Assigned Identity
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
parallelismLevel | Integer | 8 | Parallelism used when iterating subscriptions and resources |
Delta sync
Not supported. The connector performs a full sync of User Assigned Identity on every run and applies no incremental date filter.
API
- Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (
AzureResourceManager). The connector does not call raw REST paths; the SDK issues the underlyinghttps://management.azure.comrequests. · Endpoint:azure.identities().list()per subscription.
- Azure assigns the principal, client, and tenant IDs the moment an identity is created, but an identity that has not finished provisioning comes back with them unset, so all three attributes are set only when present.
Role Assignment
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
parallelismLevel | Integer | 8 | Parallelism used when iterating subscriptions and resources |
Delta sync
Not supported. The connector performs a full sync of Role Assignment on every run and applies no incremental date filter.
API
- Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (
AzureResourceManager). · Endpoint:azure.accessManagement().roleAssignments().listByScope("/subscriptions/{subscriptionId}")— one call per configured subscription. Role assignments are not a subscription-wide listable collection; they are only enumerable against a scope.
- A role assignment carries no region, resource group, or tags of its own, so those attributes are not set on this object.
Role Definition
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
parallelismLevel | Integer | 8 | Parallelism used when iterating subscriptions and resources |
Delta sync
Not supported. The connector performs a full sync of Role Definition on every run and applies no incremental date filter.
API
- Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (
AzureResourceManager). · Endpoint:azure.accessManagement().roleDefinitions().listByScope("/subscriptions/{subscriptionId}")— one call per configured subscription. Role definitions, like assignments, are only enumerable against a scope.
- A role definition carries no region, resource group, or tags of its own, so those attributes are not set on this object.
- A built-in role is returned once per subscription with a subscription-qualified resource ID — which is exactly what a role assignment's
ROLE_DEFINITION_IDpoints at. The subscription is therefore part of the definition's identity, not incidental to it: syncing two subscriptions produces twoReaderdefinitions, and each subscription's assignments join to its own copy. PERMISSIONSseparates control-plane from data-plane actions. A role that looks read-only on the control plane can still carry data actions such asMicrosoft.KeyVault/vaults/secrets/getSecret/action, so blast-radius analysis must read both lists.
Changelog
The Microsoft Azure Identity connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.6.4 | No changes in this release. | N/A |
| 3.6.3 | No changes in this release. | N/A |
| 3.6.2 | No changes in this release. | N/A |
| 3.6.1 | No changes in this release. | N/A |
| 3.6.0 | Overview The Azure Identity connector integrates with Microsoft Azure to synchronize the identity and authorization resources that determine what a workload can do: user-assigned managed identities, the role assignments that bind a principal to a role over a scope, and the role definitions those assignments grant. Where the Azure Network connector answers whether a resource can be reached, this one answers what it can do once reached — following a virtual machine's managed identity through its role assignments to the concrete permissions those roles confer, including data-plane permissions such as reading Key Vault secrets or Storage blobs. Role assignments are collected as Azure reports them, without resolving the role they point at, so the full permission set is available for analysis without repeating every built-in role's action list on every assignment. Role definitions carry a role-type discriminator that separates Microsoft's built-in roles from customer-authored custom roles, and role assignments carry any attribute-based access-control condition that narrows what the assignment actually grants. Like the other Azure connectors, it authenticates with a service principal and collects every subscription available to that principal unless a specific list is configured. The built-in Reader role at subscription scope already grants every read this connector performs — no additional permission grant is required. Category: Microsoft Azure Models | N/A |