Azure Integration

ConcertoGRC connects to Azure with workload identity federation. ConcertoGRC stores public identifiers only: your tenant ID, the Entra application client ID, and the scope IDs you selected. It does not store a client secret or certificate.

What You Get

Infrastructure

• Azure Resource Graph inventory - read-only inventory queries across the management groups or subscriptions you authorize
• Multi-subscription coverage - management group scope can include current and future child subscriptions
• Connection test - validates the Entra token exchange and a benign Resource Graph query before activation

Setup

Prerequisites

You need both Microsoft Graph permissions and Azure RBAC permissions. In some tenants these are held by different admins.

• Microsoft Graph / Entra - permission to create an application, service principal, and federated identity credential. Microsoft Graph Bicep deployments use delegated Application.ReadWrite.All for these resources.
• Azure RBAC - permission to create a custom role and role assignment at the selected management group or subscriptions.
• ConcertoGRC administrator access - permission to manage tenant integrations.

If one admin has Graph permissions and another has RBAC permissions, run the template with the admin identity that has both sets or coordinate a manual deployment in two steps.

Scope Modes

Hierarchy

Use this when you can grant access at a management group. ConcertoGRC receives Resource Graph read access at that management group and inherits visibility for child subscriptions. New child subscriptions are included on the next sync.

Explicit list

Use this when you cannot grant at management group scope. The template loops over the subscription IDs you provide and creates one role definition and assignment per subscription. New subscriptions are not included until you update the list and redeploy.

Template Artifacts

The Azure setup template source lives in infra/tenant-setup/: azure-wif.bicep, azure-wif-management-group-rbac.bicep, azure-wif-subscription-rbac.bicep, and bicepconfig.json. The compiled ARM template deployed by Azure Portal is infra/tenant-setup/azure-wif.json. The integration setup wizard shows the published ARM template URL and its SHA256 value before you open Azure Portal.

The Bicep source uses:

• Microsoft Graph Bicep extension for the Entra application, service principal, and applications/federatedIdentityCredentials
• Azure ARM resources for custom role definitions and role assignments
• A custom role with Microsoft.ResourceGraph/resources/read plus read-only ARM resource/subscription actions needed for Azure Resource Graph visibility, not the broad Reader role

Azure Portal deployment links use the compiled ARM JSON artifact because Microsoft Deploy-to-Azure links deploy remote ARM templates. The public source endpoint includes a manifest for every Bicep source/config file needed to independently rebuild the ARM JSON artifact.

After Deployment

When Azure completes the deployment, copy these outputs back into ConcertoGRC:

• Tenant ID - should match the tenant ID shown in ConcertoGRC
• Client ID - the Entra application appId
• Scope mode - HIERARCHY or EXPLICIT_LIST
• Management group IDs or subscription IDs - the scope values used in the deployment

Then run Test Connection. ConcertoGRC signs a short-lived client assertion with its Azure WIF KMS key, exchanges it through Entra, and runs a benign Azure Resource Graph query.

Troubleshooting

Symptom	Likely Cause	Resolution
Entra app or federated credential creation fails	The signed-in admin lacks Microsoft Graph application permissions	Use an admin with delegated Application.ReadWrite.All or have an Entra admin deploy the Graph portion
Custom role or role assignment creation fails	The signed-in admin lacks Azure RBAC write permissions at the selected scope	Use Owner/User Access Administrator or an equivalent custom role at the management group or subscription
Test Connection cannot exchange a token	The issuer, subject, or audience in the federated credential does not match ConcertoGRC's WIF assertion	Re-run the setup link from ConcertoGRC so the current issuer and subject parameters are pre-filled
Test Connection returns no subscriptions in explicit-list mode	The app was granted at a different subscription than the one entered in ConcertoGRC	Confirm the subscription IDs and redeploy the template