Error below when running the Azure onboarding Terraform template on your local system or Azure Cloud shell.
Could not retrieve the list of available versions for provider hashicorp/random: ... must use terraform init -upgrade to allow selection of new version
Following error during terraform apply step, while running Azure onboarding Terraform template on your local system or Azure Cloud Shell.
Access Denied error with 403 status code
Following error during terraform apply step, while running Azure onboarding Terraform template on your local system or Azure Cloud Shell.
data.azurerm_management_group.tenant_root_group: Reading...
Error: reading Management Group "\": managementgroups.Client#Get: Failure responding to request: StatusCode=404 -- Original Error: autorest/azure: Service returned an error. Status=404 Code="NotFound" Message="'/providers/Microsoft.Management/managementGroups/\' not found"
with data.azurerm\_management\_group.tenant\_root\_group,
on prisma-cloud-azure-terraform.tf.json line 26, in data.azurerm\_management\_group.tenant\_root\_group: Following error during terraform apply step, while running Azure onboarding Terraform template on your local system or Azure Cloud Shell
Error: Could not create service principal
with azuread\_service\_principal.prisma\_cloud\_sp,
on terraform (1).tf line 124, in resource "azuread\_service\_principal" "prisma\_cloud\_sp":
124: resource "azuread\_service\_principal" "prisma\_cloud\_sp" {
ServicePrincipalsClient.BaseClient.Post(): unexpected status 403 with OData error: Authorization\_RequestDenied: When using this permission, the backing application of the service principal being created must
in the local tenant
Error: Adding password for application with object ID "89d14baf-ab16-4a66-a2c8-1719b6085d28" Cloud account status shows the following error / warning for under Config on the Cloud Account Status page.
Prisma Cloud application is not assigned following role(s): User.Read.All, Application.Read.All, Reports.Read.All, Directory.Read.All, Domain.Read.All, Group.Read.All, GroupMember.Read.All, Policy.Read.All Ensure that you have granted Admin Consent to all the Microsoft Graph API Permissions on the Azure Portal and confirm that the Status column for all the API Permissions has a green checkmark.
Steps: Go to Azure tenant > App registrations > Select the Prisma Cloud app > API permissions > Grant Admin conceent for Tenant (check mark)
Verify that you have created the required roles, added the role assignments and selected Grant Admin Consent for API permissions If the issue still persists after you have eliminated the items above as an issue, confirm that you have given Prisma Cloud the appropriate Enterprise Application Object ID:
- Navigate to Enterprise Applications > All Applications.
- Search for your application in the Search box and copy the Object ID.
- Copy and paste it in Enterprise Application Object ID in the Prisma Cloud Azure Onboarding workflow and ensure that all the statuses are green in the Review Status dialog.
Following permissions are shown as missing under Agent Based Workload Protection component under the account onboarding status tab:
Prisma Cloud is not assigned the following data actions:
"Microsoft.KeyVault/vaults/keys/unwrapaction"
"Microsoft.KeyVault/vaults/keys/wrapaction" Verify that Key Vault Crypto Service Encryption User built in role is assigned at Tenant/Subscription scope to the Prisma Cloud app registration.
Cloud account status displays red and includes the following error message:
Authentication failed. Azure Subscription not found. Check whether Azure flow logs are being generated and written to the storage account:
- Log in to the Azure portal.
- Select Storage Accounts and select the storage account that you want to check.
- Select Blobs > Blob Service and navigate through the folders to find the .json files. These are the flow logs that Prisma Cloud ingests.
Check that you have created storage accounts in the same regions as the Network Security Groups.
Network Security Group (NSG) flow logs are a feature of Network Watcher that allows you to view information about ingress and egress IP traffic through an NSG. Azure flow logs must be stored within a storage account in the same region as the NSG.
- Log in to Prisma Cloud.
Select Investigate and enter the following RQL query:
network from vpc.flow\_record where source.publicnetwork IN ( 'Internet IPs', 'Suspicious IPs') AND bytes > 0This query allows you to list all network traffic from the Internet or from Suspicious IP addresses with over 0 bytes of data transferred to a network interface on any resource on any cloud environment.
Verify that you have enabled Network Watcher instance.
The Network Watcher is required to generate flow logs on Azure.
- Log in to the Azure portal and select Network Watcher > Overview and verify that the status is Enabled.
- Log in to Prisma Cloud.
Select Investigate and enter the following RQL query:
config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-network-nsg-list' addcolumn pr provisioningState
Check that you have enabled flow logs on the NSGs.
- Log in to the Azure portal, and select Network Watcher > NSG Flow Logs and verify that the status is Enabled.
- Log in to Prisma Cloud.
Select Investigate and enter the following RQL query:
network from vpc.flow\_record where source.publicnetwork IN ('Internet IPs', 'Suspicious IPs') AND bytes > 0This query allows you to list all network traffic from the Internet or from Suspicious IP addresses with over 0 bytes of data transferred to a network interface on any resource on any cloud environment.