Before creating a vDiscovery job in NIOS and performing vDiscovery in Azure, you must integrate the create a discovery application and integrate it with Microsoft Entra ID (formerly Azure Active Directory (Azure AD) to provide secure sign in and authorization. To integrate the application with Azure AD, you must first register the application details with Azure AD through Entra ID in the Azure portal.
| Excerpt |
|---|
| name | Integrating_App_with_AD |
|---|
|
You can also register a service principal using the Azure CLI or PowerShell. If you choose to use the CLI or PowerShell, refer to the Microsoft documentation for information about the Azure authentication mechanism and how to create a service principal with Azure Resource Manager |
...
. If you choose to use the Azure portal to register a service principal, you may still need to use the Azure CLI or PowerShell to customize the access scope for the newly created service principal. The default scope of access |
...
is the subscription scope that is associated with the user who creates the service principal. To create and integrate |
...
...
in the Azure portal, complete the following steps: |
...
Sign in to your Microsoft Azure account. Register an application in the Azure portal: Click All Services Search for and click Microsoft Entra ID to open it, and then click App registrations in the left panel.
Or,
Click App registrations. In the App registrations panel, either select an existing
|
...
application or click + New registration to add a new application.
|
...
 Image AddedIf you are adding a new application, enter the following details
|
...
...
the Register an application wizard
|
...
to define your application:
|
...
Name: Enter the name of your new application. The name identifies your application in Azure.
|
...
Supported account types: Select the account type as Accounts in this organizational directory only.
|
...
Redirect URI: Ensure that you use a unique URL for sign-
|
...
in purposes. Click Register to add the application.
Azure notifies you when the application is successfully created
|
...
| Note |
|---|
|
To obtain token information for the endpoints, click the Endpoints icon next to + New registration in the App registration panel. Azure displays the Endpoints page that contains endpoint information for the discovery application. vDiscovery uses the OAuth 2.0 token endpoint (v1). Copy the link from the table and use it to define the vDiscovery endpoint in NIOS. The token corresponds to the Service Endpoint field in NIOS. For more information, refer to the Infoblox NIOS Documentation. |
...
and opens the Overview page of the application. The page displays details such as Display name, Application (client) ID, Directory (tenant) ID, and Object ID. Copy the values of Application ID and the Directory ID that will be used in NIOS as Client ID and Tenant ID respectively when you define vDiscovery or DNS synchronization configurations.
Assign API permissions to your application to allow it to access the selected API. Click API permissions in the left panel, and then click + Add a permission in the API Permissions panel.
|
...
| Note |
|---|
|
Ensure that you copy the Application ID and save this value for future use. This ID is used as the Client ID in your vDiscovery configuration. |
...
In the Request API permissions panel, under Microsoft APIs, click
|
...
to select Azure Service Management as the API
|
...
...
Select Delegated permissions
|
...
and the user_impersonation checkbox to permit the application to access the API as a user.
 Image AddedClick Add permissions.
Generate a client secret for your application. The application uses it as credentials to identify itself to the authentication service. Complete the following: In the left panel, click Certificates & secrets, and then click + New client secret:
|
...
In the Add a client secret wizard, complete the following:
|
...
...
...
...
...
Click Add.
Important:
Click the Copy to clipboard icon to copy the key in the Value field and save it for future use.
The key value is displayed only at the time of the creation of the client secret. You will not be able to retrieve the
|
...
key after you leave the page
|
...
...
Image Removed
Validate all the configuration and information on this page.
Link the application to a subscription or a resource group, and then assign a role to control the access.
You can configure a vDiscovery job or a DNS sync task in NIOS to discover resources and synchronize data from multiple subscriptions linked to the application.
|
...
When you link the application to a subscription, all resources within the subscription will be discovered including the VMs, network interfaces, and
|
...
...
you do not need all entities within a subscription
|
...
to be discovered, you can configure additional granularity by individually allotting permissions to a resource group.
|
...
Resources such as VMs, network interfaces, and virtual networks within the specified resource groups will be discovered. According to the resources that must be discovered, perform one of the following:
|
...
...
Image Removed
ii. Click on the name for your subscription.
Image Removed
iii. Click Access control (IAM).
Image Removed
iv. Click Add.
Image Removed
b. To perform vDiscovery for resources on Resource group you need to perform the following:
i. Navigate to All services -> Resource groups.
Image Removed
ii. Click on the name for your Resource groups.
Image Removed
iii. Click Access control (IAM).
Image Removed
iv. Click Add
Image Removed
13. Expand the Role drop-down menu and select Reader.
14. In the Select box, type the name for your registered app, or locate and select it in the Selected members list.
15. Click Save. You have completed the vDiscovery configuration in Azure.
| Note |
|---|
|
If > Subscriptions and click the name of the subscription to link the application. Navigate to All services > Resource groups and click the name of your resource group to link the application.
In the left panel, click Access control (IAM). In the Access control (IAM) panel, click + Add > Add role assignment. In the Add role assignment wizard: In the Role panel, click Reader to select the row, and then click Next.
To discover and synchronize ALIAS records, you must assign the Contributor role to your registered application. In the Members panel, click + Select members. In the Select members panel, type the name of your registered application in the Select field to find it. In the results displayed, click the application name.
The application gets added to the Selected members list. Click Select.
Click Save.
You have completed the configuration in Azure.
Repeat Step 5 to associate multiple subscriptions or resources groups with the application.
| Note |
|---|
Note If the Reader role IAM permission is given just to the VMs instead of |
the Subscription or Resource group on Azurea subscription or a resource group, then vDiscovery will not discover any virtual entities. |
|
To configure vDiscovery jobs in NIOS, you must record the following information from the Azure portal:
...
Token Endpoint: This corresponds to the Service Endpoint field in NIOS. vDiscovery uses the OAUTH 2.0 TOKEN ENDPOINT (v1)
, however, .
The endpoint OAUTH 2.0 TOKEN ENDPOINT (v2) is not supported
. You can copy this from the Endpoints panel.
To obtain token information for the endpoints:
In the Azure portal, navigate to All services > App registrations.
In the App registrations panel, click Endpoints.
The Endpoints page appears showing the endpoint information.
Copy the link from the table and use it to define the vDiscovery endpoint in NIOS. For more information, refer to the Infoblox NIOS Documentation.
Application ID: This corresponds to the Client ID when you configure
end point the information of an endpoint in NIOS.
Key: Copy the key from the Keys panel and use
that for it in the Client Secret field in NIOS.
The following describes the corresponding fields for Azure and NIOS when you configure vDiscovery job properties:
Image Removed
...
vDiscovery Job Properties dialog box in NIOS
Image Added
| Note |
|---|
Note You can specify the same client ID and client secret for a vDiscovery job in which multiple subscriptions are associated with a single application. |
...
