Enabling Credential Checkout for Microsoft Azure

Prerequisite: Ensure that Privileged Access Manager password policies adhere to the Microsoft Azure password policies.

To enable credential checkout feature for Microsoft Azure, follow the procedure:

  1. In the Microsoft Azure cloud, create a user and assign permissions or policies to the user. For information about Microsoft Azure user creation, see Microsoft Azure documentation.

  2. In the Privileged Access Manager Administration Console,

    Add the Microsoft Azure policy template to add a resource and rule for Microsoft Azure automatically. You can customize this resource and rule as required.

    or

    Add a resource in the Credential Vault and a rule manually for Microsoft Azure. Edit the resource in Privileged Access Manager and update the following fields:

    For information about adding a resource, see the contextual help. For information about adding a rule, see Adding a Rule.

    Follow the procedure, after importing the vault:

    General:

    In the General tab, enter the name, example: https://portal.azure.com/_MSAzure. Click Next.

    Connection Details:

    • Application Type: Enter the application type as MSAzure.

    • Host Name/IP Address: Enter account ID and the URI. Example: ADAccountDomainName.onmicrosoft.com

    • Port: Enter the port number as 443.

    • SSL: Enable or disable by moving the button to the left or to the right.

    • Password Change on Check in:

      Based on the following selection the password of the application will be changed automatically every time a credential is checked in.

      • Never

        You can use this option if you do not want to change the password after every credential check-in.

      • Delegate to Identity Manager

        If you want to delegate the password check-in process to Identity Manager, select Delegate to Identity manager. Once a resource is created in Identity Manager, it gets synced to Privileged Access Manager. Resource permission is created in Privileged Access Manager but during check in and checkout password is rotated and handled by Identity Manager Driver Implementation guide on the PAM documentation page.

        NOTE:Although the latest IDM driver version is 4.8.x, ensure that you use 4.5.x version of the IDM driver package, as 4.5.x version is currently supported with Privileged Access Manager.

        NOTE:Before you delegate password check-in to Identity Manager ensure that both the Privileged Access Manager IDM driver and database driver are operational.

      • By Script

        Enter the Azure script in the text box provided.

      • Select the appropriate Password Policy that must be used when Privileged Access Manager generates a new password. By default Default Password Policy is selected. You can either modify the default password policy or create a new password policy.

        • User Name: Example, adminuser@dn.onmicrosoft.com

        • Password

      • Reconcile Account: Select based on the account.

    • Script Arguments: Enter the ClientID, Authority, and AuthenticationTokenURL.

    • In the Extended Attributes tab, click +Define and select the relevant attributes from the list.