Each Azure tenant requires a separate integration. Repeat the setup steps below for each tenant you want to connect to TENET.
Integration Setup Guide
Connect your Azure environment to TENET using the automated wizard or the manual steps below.
TENET Setup Wizard (Recommended)
The fastest way to connect TENET to your Azure environment is with the TENET Setup Wizard. It guides you through the entire process automatically — creating the app registration, configuring API permissions, and assigning the required roles — in just a few clicks. Watch the video below to see how it works.
Manual Setup
Follow these steps to manually configure the Azure app registration and permissions required by TENET.
Step 1: Creating an app registration in the Azure Portal
- Name: TENET
- Redirect URI: Select a platform: Single-page application (SPA)
- URL: https://tenet-portal.com
- Click Register
Step 2: Configure API Permissions
Ensure you select Application Permissions, not Delegated. This is required for the integration to work correctly.
D. Search for and select AuditLog.Read.All, Directory.Read.All, Reports.Read.All, SecurityEvents.Read.All, SecurityIncident.Read.All, Sites.Read.All, DeviceManagementManagedDevices.Read.All, ThreatHunting.Read.All, ServiceHealth.Read.All, MailboxSettings.Read, and AgentIdentity.Read.All
- Click add permissions
- Then click on Grant admin consent for [Your Tenant] and confirm selection
- Click + Add a permission → APIs my organization uses
- Search for Office 365 Management Activity API and select it
- Select Application permissions →
ActivityFeed.Read - Click Add permissions, then Grant admin consent
- Click + Add a permission → APIs my organization uses
- Search for
WindowsDefenderATPand select it - Select Application permissions:
Machine.Read.All,Vulnerability.Read.All,Alert.Read.All - Click Add permissions, then Grant admin consent
These permissions are non-fatal if your tenant has no Microsoft Defender for Endpoint licence. TENET will skip Defender data for unlicensed tenants.
- Click + Add a permission → APIs my organization uses
- Search for Application Insights API and select it
- Select Delegated permissions →
Data.Read - Click Add permissions, then Grant admin consent (tenant-wide)
Step 3: Assign RBAC roles
The following steps grant TENET read access to all subscriptions within the management group. To limit access to specific subscriptions only, follow the same steps but search for individual subscription names instead of Management Groups.
Global Administrator but can't access Management Groups? Follow Microsoft's guide to elevate your access.
Repeat this step three more times to also assign Cognitive Services Usages Reader, Monitoring Reader, and Security Reader. All four roles are required.
- Click on the Members tab, and then + Select members.
- In the + Select Members panel, search for the name of the app registration that you created earlier, then click on it
- Click Select at the bottom
All four roles (Reader, Cognitive Services Usages Reader, Monitoring Reader, Security Reader) are required. If not using management groups, ensure each role is assigned per individual subscription.
- Navigate to the Microsoft Entra admin center
- Go to Roles & administrators → Global Reader
- Click + Add assignments, search for your TENET app registration, and assign
Global Reader grants read access to Conditional Access policies, Identity Protection, and Intune device compliance — scoped to Entra ID rather than Azure subscriptions.
Step 4: Create Client Secret
Please take note of the Application (client) ID and Directory (tenant) ID from this page. You will need to copy these across to the TENET Platform later.
Step 5: Add Credentials to TENET
Enter a friendly Tenant Name and previously noted Tenant ID, Client ID & Client Secret then click on Start Assessment
Wait for validation and initial data fetch to complete and you can start reviewing TENET's insights.
You're done! 🎉
Managing and Monitoring Assessments
Once connected, TENET continuously monitors your Azure environment. Here's what to expect.
Full assessments run every 12 hours. Anomaly detection refreshes every hour. A manual refresh is also available in the Directories tab.
If missing permissions or invalid credentials are detected, TENET surfaces error messages in the platform. Adjust your Azure role assignments accordingly.
Plan Limits
Azure integration is available on all plans. The number of tenants you can connect depends on your plan.
Full access to all Scale plan features. Explore every capability with no restrictions during your trial.
Automated and on-demand assessments for a single Azure tenant with up to 5 platform users.
Automated and on-demand assessments for multiple tenants simultaneously with a custom number of users.
Microsoft and third-party integrations
No agents or deployments required with out of the box integrations.
Surface risk exposure across VM configuration, patching, and access
Monitor scale set configurations for drift and exposure risk
Flag unencrypted or exposed managed disks across subscriptions
Assess web app configurations for public exposure and misconfigurations
Monitor serverless functions for insecure triggers and access risk
Track App Service Plan configuration and exposure risk
Surface exposure risk across static web app deployments
Monitor container app environments for misconfiguration and exposure
Assess AKS cluster configuration and access risk
Flag public access, weak encryption, and exposed storage accounts
Surface misconfigurations and exposure risk across SQL databases
Monitor Cosmos DB access and network configuration risk
Assess Cosmos DB for MongoDB access and exposure risk
Flag public access and weak configurations on PostgreSQL servers
Flag public access and weak configurations on MySQL servers
Monitor Redis Cache instances for exposure and access risk
Monitor Redis Enterprise instances for exposure and access risk
Surface misconfigured rules and exposure on Application Gateways
Monitor Load Balancer rules for unintended public exposure
Assess VPN and ExpressRoute gateway configuration risk
Flag exposure risk across Front Door and CDN profiles
Monitor NAT Gateway configuration for outbound exposure risk
Surface exposed APIs and weak policies in API Management
Monitor Service Bus namespaces for access and network risk
Flag exposure and access risk across Event Hubs namespaces
Surface overly permissive access policies on Key Vaults
Track backup coverage and configuration risk on Recovery Vaults
Surface identity risk across users, roles, and conditional access
Ingest Defender for Cloud findings into a unified risk view
Correlate Sentinel alerts with TENET's broader risk posture
Pull Application Insights telemetry to surface operational risk
Ingest Azure Monitor metrics to flag anomalies and risk
Analyze Activity Logs to detect risky configuration changes
Track resource health signals alongside risk posture
Surface policy compliance gaps as risk exposure
Flag overly permissive NSG rules across your environment
Surface excessive permissions and role assignment risk
Query Log Analytics data to detect risk signals
Monitor Azure OpenAI deployments for access and data risk
Surface exposure risk across Cognitive Services resources
Flag misconfigured access on Azure AI Search services
Monitor Bot Service configurations for exposure risk
Assess ML workspace access and data exposure risk
Surface risk across AI Foundry projects and deployments
Ingest device threat signals to surface endpoint risk
Flag non-compliant and unmanaged devices as risk exposure
Surface oversharing and permission risk across SharePoint sites
Flag external sharing risk across OneDrive accounts
Surface mailbox rule abuse and forwarding risk
.svg){kind=icon}
Send TENET risk alerts directly to your Teams channels
Track license usage and unused seats as cost risk
Open and track TENET findings as tickets in Jira
Push TENET risk alerts directly into HaloPSA tickets
Want to learn more?
Dig into more resources.
Ready to integrate your Azure environment?
Get up and running in minutes with TENET's native Azure integration
14-day free trial · 2 min setup · No credit card required