> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Azure Authorization

> Connect Microsoft Azure role-based access control and Azure Policy to Iru Compliance using OAuth and the Azure Resource Manager API.

### About Microsoft Azure Authorization

The **Microsoft Azure Authorization** source reads **Azure RBAC** role assignments and role definitions, plus **Azure Policy** definitions and assignments, from the subscription you connect. Evidence in Iru reflects **who can access what** and **which policies are assigned**; Iru does not write changes back to Azure. Iru uses **delegated OAuth 2.0** against **Azure Resource Manager** on behalf of the user who signs in, so collections respect that user’s existing Azure permissions.

### How It Works

Iru uses Microsoft’s **OAuth 2.0 authorization code flow** (delegated permissions) against **Azure Resource Manager** (`management.azure.com`). After you sign in and consent in the pop-up, Iru receives a short-lived access token and renews it automatically (including rotating refresh tokens where applicable).

The OAuth scope requested is:

`https://management.azure.com/user_impersonation`

That grants **read** access to ARM APIs **as the signed-in user**, limited by that user’s RBAC on the subscription.

| Detail             | Value                                                  |
| ------------------ | ------------------------------------------------------ |
| **Category**       | Developer tools                                        |
| **Authentication** | OAuth 2.0 (Microsoft Entra ID, Azure Resource Manager) |
| **Vendor plan**    | Any Azure subscription                                 |

#### What Iru collects

| Data type                              | Azure ARM resource type                     |
| -------------------------------------- | ------------------------------------------- |
| Role assignments                       | `Microsoft.Authorization/roleAssignments`   |
| Role definitions (built-in and custom) | `Microsoft.Authorization/roleDefinitions`   |
| Azure Policy definitions               | `Microsoft.Authorization/policyDefinitions` |
| Azure Policy assignments               | `Microsoft.Authorization/policyAssignments` |

Iru does **not** modify role assignments or policy configuration.

Official references: [Azure RBAC documentation](https://learn.microsoft.com/azure/role-based-access-control/overview), [REST API](https://learn.microsoft.com/rest/api/authorization/), [List role assignments (concept)](https://learn.microsoft.com/azure/role-based-access-control/role-assignments-list-rest), [Built-in roles](https://learn.microsoft.com/azure/role-based-access-control/built-in-roles), [OAuth 2.0 auth code flow](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow).

### Prerequisites

* **Microsoft Entra ID** account that can sign in at the [Azure portal](https://portal.azure.com).
* At minimum the built-in **Reader** role (or equivalent read access) on the **subscription** you want Iru to read. That includes `Microsoft.Authorization/*/read` for assignments, definitions, and policy metadata.
* Browser **pop-ups** allowed so the connector wizard can open when you enable the source.

To confirm access: **Subscriptions** → your subscription → **Access control (IAM)** → **View my access**, and check for **Reader** (or higher) at that scope.

If you need a role assignment, your subscription administrator can use Azure CLI (replace placeholders):

```bash theme={null}
az role assignment create \
  --assignee <your-user-principal-name> \
  --role "Reader" \
  --scope /subscriptions/<subscription-id>
```

### Connect Microsoft Azure Authorization to Iru

Use **Microsoft Azure** first to confirm portal access and **Reader** coverage, then complete OAuth in **Iru Compliance**. The wizard shows **Step 1 of 1: Perform OAuth Authentication**.

<Tabs>
  <Tab title="Microsoft Azure">
    <Note>
      Complete this tab before you start OAuth in **Iru Compliance**.
    </Note>

    <Steps>
      <Step title="Sign in to the Azure portal">
        Open [portal.azure.com](https://portal.azure.com) and sign in with the **Microsoft Entra ID** account you will use in the Iru wizard (same tenant you want Iru to read).
      </Step>

      <Step title="Open your target subscription">
        Search for **Subscriptions**, open the **subscription** whose **Authorization** metadata (role assignments, definitions, policy) Iru should collect.
      </Step>

      <Step title="Verify Reader access">
        In the subscription, open **Access control (IAM)** → **View my access**. Confirm you see **Reader** (or another role that includes `Microsoft.Authorization/*/read` at this scope), as described under **Prerequisites**.
      </Step>

      <Step title="Allow pop-ups in your browser">
        Allow **pop-ups** for your **Iru** hostname so the Microsoft consent screen can open from the connector wizard.
      </Step>

      <Step title="Note multi-tenant pitfalls">
        If your company uses several Entra tenants, sign out of personal Microsoft accounts in the same browser profile, or use a private window, so the OAuth popup picks the **correct** work account.
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**Microsoft Azure**](#microsoft-azure) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/7HsGH7lnQ8GpVmI0/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=7HsGH7lnQ8GpVmI0&q=85&s=595982441fd777b333b3ecfea24adc24" alt="Left navigation: Compliance expanded, Sources selected" width="424" height="1056" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on the integration">
        Find **Microsoft Azure Authorization** (set **Category** to **Developer tools** or use **Search by name or description**). On that card, turn on the **toggle** to start the connector wizard.
      </Step>

      <Step title="Launch OAuth and sign in">
        Select **Launch OAuth Authentication**. When the Microsoft window opens, sign in with the same account you verified in the Azure portal and click **Accept** on the consent screen.
      </Step>

      <Step title="Finish the connection">
        When the OAuth window closes and Iru finishes the exchange, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **Microsoft Azure Authorization** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

Authorization metadata is read at **subscription** scope. To cover **multiple subscriptions**, repeat the flow per subscription or use an account with **Reader** on each subscription you need.

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="Insufficient privileges or empty data">
    Confirm the authenticating account has the **Reader** role on the **subscription** (see **Prerequisites**).
  </Accordion>

  <Accordion title="Wrong Microsoft Entra tenant">
    If your organization has several tenants, sign **out** of the Microsoft pop-up and sign in with the account for the **correct** tenant.
  </Accordion>

  <Accordion title="Broken status or re-authentication">
    Access tokens renew about every hour while the connection is active. If refresh is interrupted (for example after long inactivity), the card may show **Broken**. Turn the source **off** and **on**, then complete OAuth again.
  </Accordion>
</AccordionGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>