Connect Azure for Workload Discovery and Enforcement

Taylor Colwell

Introduction

Elisity Cloud Control Center (CCC) supports connectivity to Microsoft Azure as a cloud workload connector. Azure virtual machines are discovered into IdentityGraph as workload identities, matched by Policy Groups, and enforced under the same policy framework that governs on-premises endpoints. This extends Elisity’s identity-based microsegmentation from the campus and data center network into Azure, so a single set of policies covers traditional endpoints and cloud workloads.

Discovery is the first stage of that workflow rather than the end of it. Each discovered virtual machine carries its instance attributes, Azure tags, network interfaces, and power state into IdentityGraph, where it becomes eligible for Policy Group membership. Policy is enforced on the Enforcement IP of each network interface, and the Workload Distribution Zone assigned to the discovery endpoint determines where the policy mappings for that endpoint’s workloads are published for enforcement.

The Azure connector authenticates to a Microsoft Entra ID tenant using a service principal and discovers the virtual machines in the subscriptions and regions selected on the connector, and it keeps those virtual machines synchronized with Azure. Azure is configured as its own connector with its own credential model, separate from the Amazon Web Services connector. For AWS workload discovery, see Connect AWS for Workload Discovery and Enforcement.

This article covers the following configuration workflow:

Enabling the Workloads feature in Advanced Settings
Configuring the Azure connector with Entra ID service principal credentials
Selecting the Azure subscriptions and regions to discover
Assigning a Workload Distribution Zone to the Azure discovery endpoint
Viewing discovered workloads in IdentityGraph
Applying policy to the discovered Azure workloads

This article covers the discovery and policy enforcement of Azure virtual machines as workloads in IdentityGraph. For deploying an Elisity Virtual Edge as a virtual machine inside Azure, see Azure Cloud-Hosted Virtual Edge.

Prerequisites

Administrator access to Elisity Cloud Control Center
A Microsoft Entra ID application registration in the target Azure tenant, with a client secret. Record the Directory (tenant) ID, the Application (client) ID, and the client secret value, which is displayed only at the time the secret is created.
The Reader role assigned to that application’s service principal on each Azure subscription to be discovered. Reader is sufficient. Elisity does not require write or action permissions on any Azure resource.
At least one virtual machine in a target subscription for discovery validation
A Distribution Zone of type Workload. An Azure discovery endpoint cannot be saved until a Workload Distribution Zone is assigned to it. Create the zone from the connector’s Workload Distribution Zone list, or beforehand as described in Distribution Zones.

Enable the Workloads Feature

Step 1. Enable Workloads under Settings > System > Advanced. The Microsoft Azure connector is available only after Workloads is enabled. See Enable Workloads.

Configure the Azure Connector

After enabling Workloads, configure the Azure connector to establish connectivity to your Azure tenant and begin discovering virtual machines.

Step 2. Select Microsoft Azure

Navigate to IdentityGraph > Connectors and click + Add Connector. In the Add Connector dialog, locate Microsoft Azure and click Configure.

The connector configuration wizard opens with five steps: Authentication Setup, Azure Subscriptions, Azure Regions, Workload Distribution Zone, and Summary.

Step 3. Enter the Service Principal Credentials

Prepare the Azure Tenant

The connector authenticates as a Microsoft Entra ID application registration, also called a service principal. Complete the following in the Azure portal before you fill in the connector form. Cloud Control Center presents the same guidance on the Authentication Setup step.

Register an Application in Microsoft Entra ID

In the Azure portal, go to Microsoft Entra ID > App registrations and click + New registration.

On the Register an application page, enter a name that identifies the integration, such as Elisity Cloud Control Center Workload Discovery. Leave Supported account types set to single-tenant — each connector authenticates to one Entra ID tenant — and leave Redirect URI empty, because Elisity authenticates as a service, not on behalf of a signed-in user. Click Register.

On the application’s Overview page, record the Directory (tenant) ID and the Application (client) ID. These are the values entered as Tenant ID and Client ID on the connector form.

Create a Client Secret

On the application registration, go to Certificates & secrets and open the Client secrets tab, then click + New client secret.

In the Add a client secret panel, enter a description and select an expiry period, then click Add.

Record the secret Value as soon as it is created, and record the expiry date alongside it.

Important: Azure displays the client secret value only once, at the moment it is created. If the value is not recorded before you leave the page, the secret cannot be retrieved and a new one must be generated.

Assign the Reader Role

The application’s service principal must hold the built-in Reader role on every Azure subscription that you select on the Azure Subscriptions step. In the Azure portal, go to Subscriptions, select the subscription, then go to Access control (IAM) and select Add > Add role assignment.

On the Role tab, search for reader and select the built-in Reader role, which grants the ability to view all resources without permitting any change.

On the Members tab, click Select members, search for the application registration you created, and select it.

On the Review + assign tab, confirm that the role is Reader, that the scope is the intended subscription, and that the selected application is listed as the assigned member, then complete the assignment.

The equivalent Azure CLI command is az role assignment create --assignee <client-id> --role Reader --scope /subscriptions/<subscription-id>.

The service principal can hold Reader on several subscriptions within the same tenant, which allows one connector to span them. To limit discovery to specific subscriptions or regions, use the Azure Subscriptions and Azure Regions steps of the connector wizard, as described in Discovery Scope.

Why Reader is sufficient

Reader is both the minimum and the only role the connector requires. It grants the read-only operations Elisity uses to discover and synchronize workloads. Unlike AWS, Azure requires no custom policy document, because the built-in role already covers every permission needed:

Azure Resource Manager operation	Tier	Purpose
`Microsoft.Compute/virtualMachines/read`	Required	Lists virtual machines and reads their configuration
`Microsoft.Network/virtualNetworks/read`	Required	Enumerates virtual networks and subnets
`Microsoft.Network/networkInterfaces/read`	Required	Reads network interface and IP configuration detail
`Microsoft.Resources/subscriptions/locations/read`	Required	Enumerates the regions available to a subscription
`Microsoft.Network/routeTables/read`	Recommended	Reads the route tables associated with subnets
`Microsoft.Network/networkSecurityGroups/read`	Recommended	Reads the network security groups associated with interfaces and subnets
`Microsoft.Network/loadBalancers/read`	Recommended	Reads load balancer associations
`Microsoft.Network/publicIPAddresses/read`	Recommended	Resolves public IP allocation and assignment

Cloud Control Center lists the same operations in the Required Azure Permissions block on the Authentication Setup step. Discovery fails without the Required operations. The Recommended operations provide richer enrichment of the discovered workloads.

Important: Elisity never requires write or action permissions on any Azure resource. Do not assign Contributor, Owner, Virtual Machine Contributor, or any other role that grants write access.

Complete the Authentication Setup step with the identifiers and secret from the Entra ID application registration.

The form contains the following fields:

Field	Description
Connector Name	Required. A name that identifies this Azure discovery endpoint in Cloud Control Center.
Tenant ID	Required. The Directory (tenant) ID of the Microsoft Entra ID tenant, entered as a GUID.
Client ID	Required. The Application (client) ID of the Entra ID application registration, entered as a GUID.
Client Secret	Required. The client secret value generated for the application registration. The field is masked.
Secret Expiry Date	Optional, but strongly recommended. The expiration date of the client secret, exactly as recorded in Azure. Cloud Control Center uses this date to raise health warnings as the secret approaches expiry. Always set it: without it Cloud Control Center cannot warn you, and discovery stops with no notice on the day the secret lapses.

The connector authenticates with a client secret, and every client secret expires. Always record the Secret Expiry Date when you create the connector. It is the only thing that lets Cloud Control Center warn you before the secret lapses; without it the connector stops synchronizing without warning and discovery goes stale.

Click Test Connection. Cloud Control Center authenticates to Microsoft Entra ID with the supplied credentials and confirms that the service principal can read subscriptions in the tenant. On success, Cloud Control Center confirms that the credentials were verified.

Next becomes available only after the connection test succeeds. Click Next to continue to the Azure Subscriptions step.

Important: If the connection test fails, Cloud Control Center reports the reason. Confirm the Tenant ID and Client ID against the application registration in Azure, confirm the client secret is current, and confirm that the Reader role is assigned to the service principal on at least one subscription. See the Troubleshooting table for the individual test results and their resolutions.

Step 4. Select Azure Subscriptions

On the Azure Subscriptions step, choose which subscriptions Cloud Control Center scans for virtual machines:

All Subscriptions discovers every subscription that the service principal can access. The option label shows the number of available subscriptions.
Custom limits discovery to the subscriptions that you select from the Subscriptions list.

After selecting subscriptions, click Validate Permissions.

Cloud Control Center verifies the required permissions on each selected subscription. When every subscription passes, it reports All subscriptions verified successfully.

If a subscription fails verification, Cloud Control Center reports how many subscriptions could not be verified. Assign the Reader role to the service principal on each failed subscription and click Re-Validate, or click Remove All Failed to drop them from the selection. Next remains unavailable until every selected subscription is verified or removed. Click Next to continue.

Step 5. Select Azure Regions

On the Azure Regions step, select All Regions to discover virtual machines in every region available to the selected subscriptions, or select Custom and choose specific regions, such as East US, from the Regions list. After selecting regions, click Validate Permissions. Only the virtual machines in the selected regions of the selected subscriptions are discovered.

Cloud Control Center verifies the region selection against the selected subscriptions and reports All regions verified successfully when the check passes. Click Re-Validate to repeat the check after changing the selection, then click Next.

Step 6. Assign a Workload Distribution Zone

On the Workload Distribution Zone step, open the Workload Distribution Zone list and select the Distribution Zone for this endpoint.

If the zone does not exist yet, create it from the same list. Type a name for the new zone in the Workload Distribution Zone field, then click Create Workload Distribution Zone at the bottom of the list.

The Create Distribution Zone dialog opens with the typed name filled in as the Distribution Zone Name. The Distribution Zone Type is fixed to Workload. Optionally enter a Description, and under Advanced Settings turn on Suppress Tag Distribution if required. Click Create.

Cloud Control Center confirms that the Distribution Zone was created, and the values already entered for the connector are kept. The Workload Distribution Zone field shows a loading indicator while the new zone is registered with IdentityGraph, then selects the zone automatically. The endpoint cannot be saved until the new zone is selected.

If registration takes longer than usual, a message below the field reads The new Workload Distribution Zone is still being registered. Refresh to look for it again. Click Refresh to check again.

The following rules apply to the assignment:

The Distribution Zone must be of type Workload. Distribution Zones of other types are not listed.
The endpoint cannot be saved until a Workload Distribution Zone is assigned. No Workload Distribution Zone is created automatically, and there is no default selection.
Several discovery endpoints can reference the same Workload Distribution Zone.
If no Workload Distribution Zone exists yet, create one from the list as described above. Creating a zone requires permission to create Distribution Zones.

To create and manage Distribution Zones outside the connector, navigate to Edge Management > Distribution Zones.

Every workload the endpoint discovers inherits the endpoint’s Workload Distribution Zone. Changing the assignment on an endpoint reassigns every workload that endpoint discovered and republishes those workloads under the new Distribution Zone.

A Workload Distribution Zone is not bound to a site, and it has no Intelligent Tag Distribution setting of its own. The prefixes it contributes are still distributed to Access Distribution Zones that have Intelligent Tag Distribution enabled, unless Suppress Tag Distribution is turned on for the Workload Distribution Zone. For creating and managing Distribution Zones, see Distribution Zones.

Click Next to continue to the Summary step.

Step 7. Review the Summary and Add the Connector

The Summary step lists the authentication details, the number of selected Azure subscriptions, the number of selected Azure regions, and the Workload Distribution Zone. Click Edit on a section to return to that step and change it. Click Submit to add the connector. Cloud Control Center then begins the initial discovery cycle, and discovered workloads appear in IdentityGraph within about five minutes.

Discovery Scope

Each Azure connector authenticates to a single Entra ID tenant, and it discovers virtual machines in the subscriptions and regions selected on the connector. A subscription passes verification only when the service principal holds the required permissions on it, which the built-in Reader role provides.

A single connector can span multiple subscriptions within one tenant. To discover virtual machines in more than one Entra ID tenant, add a separate connector for each tenant.

To change the scope after the connector is created, navigate to IdentityGraph > Connectors, expand the Azure connector row, and select Edit from the row actions menu on the discovery endpoint. The wizard opens with the current configuration, and the stored client secret is retained. To change the subscription selection, re-enter the client secret on the Authentication Setup step; Cloud Control Center requires it to validate a changed subscription selection. Region and Workload Distribution Zone changes are validated without re-entering the secret.

Cloud Control Center polls Azure at a five-minute interval by default and updates the attributes, network interfaces, and power state of the discovered virtual machines on each cycle. Virtual machines that are deleted in Azure are removed from IdentityGraph on the sync cycle that no longer returns them.

View Discovered Workloads

Step 8. Navigate to IdentityGraph > Workloads. After the connector's first discovery cycle, the virtual machines in the selected subscriptions and regions are listed with their subscription ID and name, virtual network and subnet names, and Azure tags.

Azure reports both stopped and deallocated virtual machines as Stopped. Long Azure resource identifiers are shortened for display, with the full identifier in a tooltip. On the Network Interfaces tab, the network security group applied to the network interface is shown; network security groups applied at the subnet are not.

For the Workloads page, workload details and editing, see Workloads.

Apply Policy to Azure Workloads

Azure workloads are classified into Workload Policy Groups by their attributes, Azure tags and labels, and policy between campus devices and Azure workloads is written in the Policy Matrix. See Classify Workloads.

Policy is enforced on each network interface's Enforcement IP. For setting the Enforcement IP, how duplicate addresses are resolved, and how the Workload Distribution Zone distributes the mappings, see Enforcement IP.

Operationalization

Connector Status

After adding the Azure connector, verify its status by navigating to IdentityGraph > Connectors. The Microsoft Azure connector displays an Active status when Cloud Control Center is authenticating to Azure and discovering virtual machines at the configured interval. Expand the Azure connector row to display the discovery endpoint beneath it with its own status. Use the row actions menu on the connector endpoint to edit, sync, or delete it.

Client Secret Rotation

Azure client secrets expire. Cloud Control Center tracks the Secret Expiry Date recorded on the connector and raises connector health warnings at 30 days, 7 days, and 1 day before the secret expires. If the secret expires, the connector moves to an Inactive status and discovery stops until a valid secret is supplied.

To rotate the secret, generate a new client secret on the Entra ID application registration, then edit the Azure connector and replace the Client Secret value and the Secret Expiry Date. Run Test Connection to confirm the new secret, then click Finish. The connector does not need to be deleted and recreated, and the workloads it discovered are retained.

Verification

To confirm that the Azure cloud workloads integration is functioning correctly:

Navigate to IdentityGraph > Connectors and confirm the Microsoft Azure connector reports an Active status.
Navigate to IdentityGraph > Workloads and confirm that virtual machines from the selected subscriptions and regions appear in the workload list.
Select an individual Azure workload and confirm that its instance attributes and Azure tags are populated.
Open the Network Interfaces tab on the workload and confirm that each interface reports its IP addresses, subnet, and network security group.
Navigate to IdentityGraph > Workloads and review the Enforcement IP Address column. A workload that shows -- is not enforced on any address and is not matched by policy; resolve the duplicate address as described in Duplicate Addresses.
Confirm that the Azure workloads are matched by the Policy Groups intended to govern them.
Change a tag or the power state on a virtual machine in Azure and confirm that the change is reflected in Cloud Control Center after the next sync cycle.

Troubleshooting

Issue	Resolution
Workloads navigation item does not appear	Verify that the Workloads feature is enabled under Settings > System > Advanced. The toggle must be in the on position.
Microsoft Azure is not offered in the Add Connector dialog	The Microsoft Azure connector is available only after the Workloads feature is enabled. Enable it under Settings > System > Advanced, then reopen the Add Connector dialog.
Connection test reports that the app was not found	The Client ID does not match an application registration in the specified tenant. Confirm the Application (client) ID and confirm that it belongs to the tenant identified by the Tenant ID.
Connection test reports an invalid secret	The client secret is incorrect or has expired. Generate a new client secret on the application registration in Azure, enter the new secret value, update the Secret Expiry Date, and test again.
Connection test reports that the tenant was not found	The Tenant ID is incorrect. Enter the Directory (tenant) ID of the Entra ID tenant that contains the application registration.
Connection test reports valid credentials but no subscription access	The service principal authenticated, but it holds no role on any subscription in the tenant. Assign the Reader role to the service principal on each subscription to be discovered, then test again.
Connection test reports that Azure could not be reached	Cloud Control Center could not complete the request to Azure. Confirm that no outbound restriction is blocking access to the Microsoft Entra ID and Azure Resource Manager endpoints, then test again.
Next is unavailable on the Authentication Setup step	The wizard continues only after a successful connection test. Complete every required field, click Test Connection, and click Next once the test succeeds.
The Workload Distribution Zone list is empty	Only Distribution Zones of type Workload are listed. Type a name and click Create Workload Distribution Zone at the bottom of the list, or create one under Edge Management > Distribution Zones and reopen the list. If the list offers no create action, the account does not have permission to create Distribution Zones, and an administrator with that permission must create the zone.
A Workload Distribution Zone created from the connector is not selected	The zone is still being registered with IdentityGraph. Click Refresh in the message below the Workload Distribution Zone field. The zone is selected automatically when it appears.
No workloads appear after the connector is added	Allow one sync cycle to complete. Confirm that virtual machines exist in a subscription where the service principal holds the Reader role, and confirm the connector status is Active.
Virtual machines in one subscription are missing	Confirm that the subscription is selected on the connector, or that All Subscriptions is selected, and that its region is included in the region selection. Confirm that the service principal holds the Reader role on the subscription. If the scope needs to change, edit the discovery endpoint from the connector row actions menu, re-enter the client secret on the Authentication Setup step, and update the subscription selection, then run a sync.
A subscription fails verification on the Azure Subscriptions step	The service principal lacks one or more required permissions on that subscription. Assign the built-in Reader role on the subscription, then click Re-Validate, or click Remove All Failed to drop the failed subscriptions from the selection.
Virtual machines in a region are missing	The region is not included in the connector’s region selection. Edit the discovery endpoint, add the region or select All Regions, and click Finish.
The connector moved to Inactive	The client secret has expired. Generate a new secret in Azure, edit the connector to enter the new secret value and Secret Expiry Date, and test the connection.
A deallocated virtual machine displays as Stopped	This is expected. Azure stopped and deallocated power states both display as Stopped, and the Azure power state is preserved on the workload record.
A workload is not matched by policy	The interface is not enforced on its Enforcement IP because that address conflicts with a network device or with another workload interface. Devices take priority over workloads. Where two workload interfaces present the same Enforcement IP, the interface that already holds the address keeps it and the other is not enforced on that address; the existing assignment is never preempted. Correct the duplicate address, then recheck the Network Interfaces tab.
A Distribution Zone cannot be deleted	A Distribution Zone referenced by a discovery endpoint cannot be deleted. Reassign every endpoint that references it, then delete the Distribution Zone.