Update Azure Application Permissions

Even after you have completed onboarding, you have the option to add or remove Prisma Cloud Security Capabilities. Learn how you can add additional capabilities and the required associated permissions in your Azure subscriptions or tenants after onboarding. To verify if you have missing permissions authenticate into Prisma Cloud and select Settings > Cloud Accounts, and view the Status column.

Update Azure Custom Role Permissions

Before you add new new Security Capabilities, you must first update the permissions granted to the existing custom role created during the onboarding process. This workflow is only available for Azure Tenant and Subscription onboarding. Additionally, Azure China does not support the use of Terraform templates.

Using Terraform Script (Recommended)

Follow the steps below to update your custom role permissions and add or modify existing Prisma Cloud Security Capabilities.

1. Authenticate using Azure CLI.
2. Navigate to the directory you created during the onboarding process to store the Terraform file. Sample directory names include onboard-tenant-<tenant-name> or onboard–subscription-<subscription-name>. Ensure that the directory contains the terraform.tfstate file created during the terraform apply step.
3. Select the required features under Security Capabilities and Permissions section in the Get Started dialog.
4. Download the Terraform again by clicking on Edit Cloud Account > Configure Account > Download Terraform Script button. The newly downloaded Terraform file contains the updated permissions.
5. Run the command terraform init > terraform apply and click Confirm.
6. The existing custom role is now updated with new permissions, once the Terraform execution is completed.

   If the terraform.tfstate file is not present in the directory, when the Terraform script is executed, a new app is registered and a new custom role is created.

Manually update Custom Roles

If your organization restricts the use of Terraform scripts, you can choose to manually add the new permissions to the existing custom roles.

1. Authenticate into Azure portal.
2. For Tenant onboarding: Navigate to All Services > Management Groups. Click on Tenant Root Group For Subscription onboarding: Navigate to All Services > Subscriptions.
3. Select Access Control (IAM) > Roles.
4. Search for the custom role created during onboarding in the Search box and click on the Edit button.
5. Update the custom role page, click on JSON. You can view your existing custom role JSON with the permissions under the actions list.
6. Click on the Edit button, append the comma separated new permissions in the actions list. Click on Save > Review + update.
7. Verify your Role name and Permissions. Click on Update. Wait for few minutes for the custom role to update.

Add Microsoft Graph API Permissions

Follow the steps below to assign graph API permissions at the tenant level.

1. Add the required permissions.

   1. Navigate to the app you previously registered. Select Azure > Active > Directory > App registrations, and select your app.
   2. Navigate to Microsoft Graph. Select API > permissions > Add a permission > Microsoft Graph > Application permissions.
   3. Add the permissions. Enter the permission name in Select permissions, and select the name from Permission. Add the following permissions:

      • User.Read.All
      • Policy.Read.All
      • Group.Read.All
      • GroupMember.Read.All
      • Reports.Read.All
      • Directory.Read.All
      • Domain.Read.All
      • Application.Read.All

        If you have enabled additional functions like Agentless Scanning or Workload Protection additional permissions will be required. Review the Roles and Permissions list for the required permissions.
2. Grant admin consent for Default Directory.

   1. Select Grant admin consent for Default Directory > Yes.
   2. Verify that the permissions are granted.
   3. Confirm that you can see green check marks under the Status column.