> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/connect-microsoft-entra-id.md).

# Connect a Microsoft Entra ID Tenant

Learn how to [Connect Commercial Microsoft Entra ID Tenant](#commercial), [Connect Government Microsoft Entra ID Tenant](#government), or [Connect Azure China Subscription](#china) cloud resources on Prisma Cloud. Onboarding an **Microsoft Entra ID** (previously known as Active Directory) tenant connects the resources within your Azure subscription to Prisma Cloud.

Connecting Prisma® Cloud to your Azure cloud account enables you to analyze and monitor traffic logs, and detect potential malicious network activity or compliance issues. During the built-in onboarding process you have the option of using one of the following three methods to create the required Azure resources to authorize Prisma Cloud to access Azure APIs:

* [Terraform](/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/authorize-prisma-cloud.md#terraform) (Recommended) This workflow automates the process of setting up the Prisma Cloud application on Microsoft Entra ID and enables read-only or read-write access to your Azure subscription.

Azure China workflows do not support the use of Terraform templates.

* [Using Custom Role JSON](/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/authorize-prisma-cloud.md#json) Using a manually created Custom Role you also have the option to enforce least access privilege to restrict access. To achieve this you will need to manually set up the Prisma Cloud application on Microsoft Entra ID and Create a Custom Role to authorize access to Azure APIs.
* [Manually Authorizing Prisma Cloud](/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/authorize-prisma-cloud.md#manual) If your organization restricts the use of Terraform scripts, you can choose to manually create the required Azure resources for Prisma Cloud to call the Azure APIs.

## Connect Commercial Microsoft Entra ID Tenant

Ensure that you’ve reviewed the [onboarding prerequisites](/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/connect-azure-account.md#prerequisites) prior to starting the onboarding process.

1. **Get Started**
   1. [Access Prisma Cloud](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/connect/connect-cloud-accounts/get-started/access-prisma-cloud.md) and select **Settings > Cloud Accounts > Add Cloud Account**.
   2. Choose **Azure** as the **Cloud to Secure**.
   3. Select **Microsoft Entra ID** (Active Directory) under **Scope**.
   4. Select **Commercial** as the **Deployment Type**.
   5. **Security Capabilities and Permissions > Misconfigurations** is enabled by default to allow Prisma Cloud to detect misconfigurations and verify compliance.
   6. Click **Next** to proceed with the onboarding flow.
2. **Configure Account**
   1. On the **Configure Account** page provide your **Account Details** including **Directory Tenant ID** and choose an **Account Name**.
   2. If you’re using the recommended Terraform template to provide the required account details, click **Download Terraform Script** and enter the form details from the script output. Provide [details](/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/authorize-prisma-cloud.md#terraform) for **Application (Client) ID**, **Application Client Secret**, **Enterprise Application Object ID** from the script output.
   3. You can also select a Default Account Group, or choose from one of the Account Groups in the drop-down.
   4. Click Next.
3. **Review Status**
   1. On the **Review Status** page, ensure that all the **Security Capabilities** you have selected display a green Enabled button. If **Checks Failed** appears next to a selected function. Click the drop-down next to the failed check and add the missing permissions listed.
   2. Click **Save and Close** to complete onboarding or **Save and Onboard Another Account**.
   3. If an onboarded account displays a yellow or red status, you can either reload or refresh the cloud account and it’s associated security capabilities. Select **Home > Settings > Providers > Cloud Accounts** and click on the **Status** of the cloud account you want to refresh. Next, select the refresh button on the **Status** window to reload your cloud account.

Misconfigurations in your Azure subscription may lead to errors when onboarding your Microsoft Entra ID account. Register the `Microsoft.Subscriptions` resource provider for the affected subscriptions to resolve the issue.

## Connect Government Microsoft Entra ID Tenant

To add an Azure Government account follow the steps outlined under Azure Commercial above, with the following exception:

* During the Get Started step, select **Government** as the deployment type.

## Connect Azure China Subscription

Account onboarding on [Prisma Cloud](https://app.prismacloud.cn/) is only available for cloud resources currently deployed on Azure China. Follow the steps outlined under Azure Subscription above to onboard an Azure China account with the following exception:

* Azure China does not support the use of Terraform templates to onboard a cloud account. To get started with monitoring your Azure China Subscription, review the [manual onboarding steps](/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/authorize-prisma-cloud.md#manual) and gather the required information from your Azure China account.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/connect-microsoft-entra-id.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.