Microsoft Azure Network
Microsoft Azure- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Azure Network connector integrates with Microsoft Azure and synchronizes the network resources that determine a workload's internet exposure and blast radius, using the Azure Resource Manager APIs (via the Azure SDK for Java). For each configured subscription it lists network interfaces, public IP addresses, network security groups, virtual networks, virtual network peerings, route tables, load balancers, and application gateways, and maps each to a Cloud Resource connector object.
Every resource carries its full Azure Resource Manager ID in RESOURCE_ID, and the references between resources are published as the same ARM IDs — so a network interface joins to the virtual machine that owns it, to the security group governing it, and to the public IP and subnet it is bound to, without any additional lookup. The network interface is the hinge of that chain: it is the object that ties a virtual machine to the addresses and rules that expose it.
When no subscription is configured the connector enumerates every subscription accessible to the configured Azure AD application; otherwise it processes only the comma-separated subscriptions provided. Subscriptions and resources are processed in parallel, and a subscription the service principal cannot read is logged and skipped rather than failing the whole sync.
Data retrieved from Microsoft Azure Network
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Network Interface | Yes | Cloud Resource |
| Public IP Address | Yes | Cloud Resource |
| Network Security Group | Yes | Cloud Resource |
| Virtual Network | Yes | Cloud Resource |
| Virtual Network Peering | Yes | Cloud Resource |
| Route Table | Yes | Cloud Resource |
| Load Balancer | Yes | Cloud Resource |
| Application Gateway | Yes | Cloud Resource |
Model relationships
For detailed steps on how to view the data retrieved from Microsoft Azure Network in the Brinqa Platform, see How to view your data.
The Public IP Address row is the one join here that matches on a value, not on a resource ID. A dynamically allocated address is released and reassigned, so the same address seen on a virtual machine and on a public IP resource is not proof they are the same resource at the same moment.
Prefer the resource-ID path, which is exact and stable: Virtual Machine NETWORK_INTERFACE_IDS → Network Interface RESOURCE_ID, then Network Interface IP_CONFIGURATIONS[].publicIpId → Public IP Address RESOURCE_ID (an intra-connector link, drawn as the Network Interface → Public IP Address edge above). Use the address match only to corroborate it.
Connection settings
When setting up a data integration, select Microsoft Azure Network from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Client ID | Yes | — | The service principal client ID. The client ID is generated during service principal registration. |
| Client secret | Yes | — | The service principal client secret or password. |
| Tenant ID | Yes | — | The tenant or domain the credential is authorized for. The tenant ID is generated during service principal registration. |
| Subscription ID | No | — | (Optional) Comma-separated list of Subscription IDs. If none is specified, the connector will automatically discover all subscriptions for the tenant. |
Authentication
Method
Azure Active Directory OAuth 2.0 Client Credentials (client ID + client secret + tenant ID), performed by the Azure SDK for Java (ClientSecretCredential) against the Azure public-cloud Active Directory endpoint.
Endpoint
| Method | URL |
|---|---|
POST | https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token |
The token request is issued internally by the Azure Identity library when an AzureResourceManager client is authenticated; the connector does not call the token endpoint directly.
Request Body (form-urlencoded)
| Parameter | Value |
|---|---|
grant_type | client_credentials |
client_id | {clientId} |
client_secret | {clientSecret} |
scope | https://management.azure.com/.default |
Sample Response
{
"token_type": "Bearer",
"expires_in": 3599,
"ext_expires_in": 3599,
"access_token": "<access_token>"
}
Response Fields
| Field | Type | Description |
|---|---|---|
token_type | String | Authorization scheme prefix (Bearer) |
expires_in | Integer | Token lifetime in seconds |
ext_expires_in | Integer | Extended token lifetime in seconds |
access_token | String | Bearer token applied to subsequent Azure Resource Manager requests |
Usage
The Azure SDK attaches the bearer token to every Azure Resource Manager request and refreshes it automatically:
Authorization: Bearer <access_token>
The credential is built once and reused per subscription, scoped via withSubscription({subscriptionId}).
Required Permissions
The built-in Reader role at subscription scope is sufficient for every object type this connector syncs — it grants the Microsoft.Network/*/read operations the resource lists require. No custom role is needed, and the connector never writes to Azure.
Sync Behavior
The connector performs a full sync on every run. Azure Resource Manager does not provide an incremental change filter for any of the network resource lists, so each sync enumerates all resources of the requested type across the configured subscriptions (or all accessible subscriptions when none is configured). Incremental (delta) syncs are not supported.
How to obtain Microsoft Azure Network credentials
Obtain the required credentials (clientId, clientSecret, tenantId) from your Microsoft Azure Network administrator or the Microsoft Azure Network admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Network Interface
| Source Field Name | SDM Attribute |
|---|---|
| :--- | :--- |
| Boolean | primary |
NetworkInterface.id | UID |
NetworkInterface.id | RESOURCE_ID |
NetworkInterface.ipConfigurations | IP_CONFIGURATIONS |
NetworkInterface.isIPForwardingEnabled | IP_FORWARDING_ENABLED |
NetworkInterface.macAddress | MAC_ADDRESSES |
NetworkInterface.name | NAME |
NetworkInterface.networkSecurityGroupId | NSG_ID |
NetworkInterface.primaryPrivateIP | PRIMARY_PRIVATE_IP |
NetworkInterface.regionName | REGION |
NetworkInterface.resourceGroupName | RESOURCE_GROUP |
NetworkInterface.tags | TAGS |
NetworkInterface.virtualMachineId | VM_ID |
| String | name |
| String | privateIp |
| String | privateIpAllocationMethod |
| String | publicIpId |
| String | subnetId |
| Subscription being synced | SUBSCRIPTION_ID |
| Type | Field |
Public IP Address
| Source Field Name | SDM Attribute |
|---|---|
PublicIpAddress.fqdn | PUBLIC_DNS_NAMES |
PublicIpAddress.id | UID |
PublicIpAddress.id | RESOURCE_ID |
PublicIpAddress.ipAddress | PUBLIC_IP_ADDRESSES |
PublicIpAddress.ipAllocationMethod | ALLOCATION_METHOD |
PublicIpAddress.ipConfiguration.id | IP_CONFIGURATION_ID |
PublicIpAddress.name | NAME |
PublicIpAddress.regionName | REGION |
PublicIpAddress.resourceGroupName | RESOURCE_GROUP |
PublicIpAddress.sku.name | SKU_NAME |
PublicIpAddress.tags | TAGS |
PublicIpAddress.version | IP_VERSION |
| Subscription being synced | SUBSCRIPTION_ID |
Network Security Group
| Source Field Name | SDM Attribute |
|---|---|
| :--- | :--- |
| Integer | priority |
| List | sourceAddressPrefixes |
| List | destinationAddressPrefixes |
| List | sourcePortRanges |
| List | destinationPortRanges |
| List | sourceApplicationSecurityGroupIds |
| List | destinationApplicationSecurityGroupIds |
NetworkSecurityGroup.defaultSecurityRules | DEFAULT_SECURITY_RULES |
NetworkSecurityGroup.id | UID |
NetworkSecurityGroup.id | RESOURCE_ID |
NetworkSecurityGroup.listAssociatedSubnets[].id | SUBNET_IDS |
NetworkSecurityGroup.name | NAME |
NetworkSecurityGroup.networkInterfaceIds | NETWORK_INTERFACE_IDS |
NetworkSecurityGroup.regionName | REGION |
NetworkSecurityGroup.resourceGroupName | RESOURCE_GROUP |
NetworkSecurityGroup.securityRules | SECURITY_RULES |
NetworkSecurityGroup.tags | TAGS |
| String | name |
| String | direction |
| String | access |
| String | protocol |
| String | description |
| Subscription being synced | SUBSCRIPTION_ID |
| Type | Field |
Virtual Network
| Source Field Name | SDM Attribute |
|---|---|
| :--- | :--- |
| List | serviceEndpoints |
Network.addressSpaces | ADDRESS_PREFIXES |
Network.dnsServerIPs | DNS_SERVERS |
Network.id | UID |
Network.id | RESOURCE_ID |
Network.name | NAME |
Network.regionName | REGION |
Network.resourceGroupName | RESOURCE_GROUP |
Network.subnets | SUBNETS |
Network.tags | TAGS |
| String | id |
| String | name |
| String | addressPrefix |
| String | nsgId |
| String | routeTableId |
| Subscription being synced | SUBSCRIPTION_ID |
| Type | Field |
Virtual Network Peering
| Source Field Name | SDM Attribute |
|---|---|
NetworkPeering.allowForwardedTraffic | ALLOW_FORWARDED_TRAFFIC |
NetworkPeering.allowGatewayTransit | ALLOW_GATEWAY_TRANSIT |
NetworkPeering.allowVirtualNetworkAccess | ALLOW_VNET_ACCESS |
NetworkPeering.id | UID |
NetworkPeering.id | RESOURCE_ID |
NetworkPeering.name | NAME |
NetworkPeering.networkId | VNET_ID |
NetworkPeering.remoteNetworkId | REMOTE_VNET_ID |
NetworkPeering.resourceGroupName | RESOURCE_GROUP |
NetworkPeering.state | PEERING_STATE |
| Subscription being synced | SUBSCRIPTION_ID |
Route Table
| Source Field Name | SDM Attribute |
|---|---|
| :--- | :--- |
RouteTable.id | UID |
RouteTable.id | RESOURCE_ID |
RouteTable.listAssociatedSubnets[].id | SUBNET_IDS |
RouteTable.name | NAME |
RouteTable.regionName | REGION |
RouteTable.resourceGroupName | RESOURCE_GROUP |
RouteTable.routes | ROUTES |
RouteTable.tags | TAGS |
| String | name |
| String | addressPrefix |
| String | nextHopType |
| String | nextHopIpAddress |
| Subscription being synced | SUBSCRIPTION_ID |
| Type | Field |
Load Balancer
| Source Field Name | SDM Attribute |
|---|---|
| :--- | :--- |
| :--- | :--- |
| :--- | :--- |
| :--- | :--- |
| Boolean | isPublic |
| Boolean | floatingIpEnabled |
| Flattened from BACKEND_POOLS | BACKEND_NIC_IP_CONFIG_IDS |
| Integer | frontendPort |
| Integer | backendPort |
| Integer | idleTimeoutInMinutes |
| Integer | frontendPort |
| Integer | backendPort |
| List | backendNicIpConfigIds |
LoadBalancer.backends | BACKEND_POOLS |
LoadBalancer.frontends | FRONTEND_IP_CONFIGURATIONS |
LoadBalancer.id | UID |
LoadBalancer.id | RESOURCE_ID |
LoadBalancer.inboundNatRules | INBOUND_NAT_RULES |
LoadBalancer.loadBalancingRules | LOAD_BALANCING_RULES |
LoadBalancer.name | NAME |
LoadBalancer.regionName | REGION |
LoadBalancer.resourceGroupName | RESOURCE_GROUP |
LoadBalancer.sku.name | SKU_NAME |
LoadBalancer.tags | TAGS |
| String | name |
| String | publicIpId |
| String | privateIp |
| String | subnetId |
| String | name |
| String | name |
| String | protocol |
| String | frontendName |
| String | backendName |
| String | name |
| String | protocol |
| String | frontendName |
| String | backendNetworkInterfaceId |
| String | backendNicIpConfigurationName |
| Subscription being synced | SUBSCRIPTION_ID |
| Type | Field |
| Type | Field |
| Type | Field |
| Type | Field |
Application Gateway
| Source Field Name | SDM Attribute |
|---|---|
| :--- | :--- |
| :--- | :--- |
| :--- | :--- |
| :--- | :--- |
ApplicationGateway.backends | BACKEND_POOLS |
ApplicationGateway.frontends | FRONTEND_IP_CONFIGURATIONS |
ApplicationGateway.id | UID |
ApplicationGateway.id | RESOURCE_ID |
ApplicationGateway.listeners | HTTP_LISTENERS |
ApplicationGateway.name | NAME |
ApplicationGateway.regionName | REGION |
ApplicationGateway.requestRoutingRules | REQUEST_ROUTING_RULES |
ApplicationGateway.resourceGroupName | RESOURCE_GROUP |
ApplicationGateway.tags | TAGS |
ApplicationGateway.webApplicationFirewallConfiguration.enabled | WAF_ENABLED |
| Boolean | isPublic |
| Boolean | requiresServerNameIndication |
| Flattened from BACKEND_POOLS | BACKEND_ADDRESSES |
| Integer | frontendPort |
| Integer | priority |
| List | addresses |
| String | name |
| String | publicIpId |
| String | privateIp |
| String | subnetId |
| String | name |
| String | name |
| String | protocol |
| String | hostname |
| String | frontendName |
| String | publicIpId |
| String | name |
| String | ruleType |
| String | listenerName |
| String | backendName |
| String | backendHttpConfigurationName |
| String | redirectConfigurationName |
| Subscription being synced | SUBSCRIPTION_ID |
| Type | Field |
| Type | Field |
| Type | Field |
| Type | Field |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Network Interface
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
parallelismLevel | Integer | 8 | Parallelism used when iterating subscriptions and resources |
Delta sync
Not supported. The connector performs a full sync of Network Interface on every run and applies no incremental date filter.
API
- Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (
AzureResourceManager). The connector does not call raw REST paths; the SDK issues the underlyinghttps://management.azure.comrequests. · Endpoint:azure.networkInterfaces().list()
- The subnet ID in each IP configuration is read from the object the list call already returned, so enriching the configuration costs no additional Azure request.
Public IP Address
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
parallelismLevel | Integer | 8 | Parallelism used when iterating subscriptions and resources |
Delta sync
Not supported. The connector performs a full sync of Public IP Address on every run and applies no incremental date filter.
API
- Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (
AzureResourceManager). · Endpoint:azure.publicIpAddresses().list()
- The address is identified by its resource ID alone, never by the address itself: a dynamically allocated address is released and reassigned, so identifying on the address would merge two distinct resources that happened to hold it at different times.
Network Security Group
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
parallelismLevel | Integer | 8 | Parallelism used when iterating subscriptions and resources |
Delta sync
Not supported. The connector performs a full sync of Network Security Group on every run and applies no incremental date filter.
API
- Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (
AzureResourceManager). · Endpoint:azure.networkSecurityGroups().list()
- Azure exposes every address and port dimension twice — a singular field and a plural one — and populates exactly one of them per rule. The connector collapses each pair into a single list so the shape stays stable for consumers without discarding either form.
Virtual Network
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
parallelismLevel | Integer | 8 | Parallelism used when iterating subscriptions and resources |
Delta sync
Not supported. The connector performs a full sync of Virtual Network on every run and applies no incremental date filter.
API
- Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (
AzureResourceManager). · Endpoint:azure.networks().list()
ADDRESS_PREFIXESis kept as one list rather than split across separate IPv4 and IPv6 attributes: Azure returns a single address space that may hold either family, and separating them would mean parsing every prefix.
Virtual Network Peering
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
parallelismLevel | Integer | 8 | Parallelism used when iterating subscriptions and resources |
Delta sync
Not supported. The connector performs a full sync of Virtual Network Peering on every run and applies no incremental date filter.
API
- Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (
AzureResourceManager). · Endpoint:azure.networks().list()
- A peering is a child resource and carries no region or tags of its own, so
REGIONandTAGSare not set on this object. - A failure listing one network's peerings is scoped to that network — the rest of the page still syncs.
- A peering is directional: a fully connected pair of networks produces two peering objects, one from each side.
Route Table
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
parallelismLevel | Integer | 8 | Parallelism used when iterating subscriptions and resources |
Delta sync
Not supported. The connector performs a full sync of Route Table on every run and applies no incremental date filter.
API
- Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (
AzureResourceManager). · Endpoint:azure.routeTables().list()
Load Balancer
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
parallelismLevel | Integer | 8 | Parallelism used when iterating subscriptions and resources |
Delta sync
Not supported. The connector performs a full sync of Load Balancer on every run and applies no incremental date filter.
API
- Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (
AzureResourceManager). · Endpoint:azure.loadBalancers().list()
Application Gateway
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
parallelismLevel | Integer | 8 | Parallelism used when iterating subscriptions and resources |
Delta sync
Not supported. The connector performs a full sync of Application Gateway on every run and applies no incremental date filter.
API
- Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (
AzureResourceManager). · Endpoint:azure.applicationGateways().list()
Changelog
The Microsoft Azure Network connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.6.1 | No changes in this release. | N/A |
| 3.6.0 | Overview The Azure Network connector integrates with Microsoft Azure to synchronize the network resources that determine whether a workload is reachable from the internet: network interfaces, public IP addresses, network security groups and their rules, virtual networks and their peerings, route tables, load balancers, and application gateways. Each resource carries the Azure Resource Manager IDs of the resources it is attached to, so the platform can follow a virtual machine out to its public address and back through the rules that permit the traffic. Like the Azure Compute connector, it authenticates with a service principal and collects every subscription available to that principal unless a specific list is configured. Category: Microsoft Azure Models | N/A |