Inventorying Microsoft Azure. Inventorying Microsoft Azure Information with Docusnap X

Transcription

1 Inventorying Microsoft Azure Inventorying Microsoft Azure Information with Docusnap X

2 TITLE Inventorying Microsoft Azure AUTHOR Docusnap Consulting DATE 2/7/2018 VERSION 1.0 valid from January 25, 2018 This document contains proprietary information. The reproduction and distribution of this document as a whole or in part as well as the utilization and disclosure of its contents to third parties without the express authorization by itelio GmbH are prohibited. Offenders will be held liable for the payment of indemnification. All rights reserved. Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 2 of 27

3 TABLE OF CONTENTS About this Document Structure of this Document Licensing requirements for using the Docusnap Azure Inventory feature 5 How to Prepare Your Azure Environment for Docusnap Overview of the Preparations in Azure Azure Preparations Required Permission Creating the New Docusnap Inventory Application Opening the New application registration dialog Creating the Docusnap Inventory application Determining the application ID and saving it for the Docusnap scan dialog Opening the application settings Creating the application key and saving it for the Docusnap scan dialog Authorizing the Docusnap Inventory application Authorizing the Docusnap Inventory application for all desired subscriptions Assigning the Reader role to the Docusnap Inventory application per subscription Azure Active Directory Determining the Directory ID Determining and saving the directory ID Summary 16 Inventorying the Azure Cloud with Docusnap Docusnap Azure Inventory Wizard Prerequisite: proxy configuration The Docusnap Azure Inventory scan dialog Starting the Azure Inventory wizard Azure scan dialog Company Selection Azure scan dialog Domain Selection Azure Inventory Selecting subscriptions Completing the Azure scan settings Azure scan dialog Naming the snapshot, summary and schedule Azure Scan Result in Docusnap Azure Report 24 Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 3 of 27

4 Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 4 of 27

5 About this Document Docusnap now also inventories cloud environments. In January 2018, we added the Docusnap Azure Inventory feature to Docusnap. This document describes the steps required to collect and map information from your Microsoft Azure infrastructure in Docusnap. 1.1 Structure of this Document Chapter 2 How to prepare your Azure environment for the inventory with Docusnap Chapter 3 How to schedule and perform an Azure inventory with Docusnap 1.2 Licensing requirements for using the Docusnap Azure Inventory feature The Docusnap Azure Inventory feature requires the installation of the Docusnap X Basic edition or a higher version. To be entitled to use this feature, a valid Service Agreement must be in effect at the time of release of this module (i.e. January 31, 2018). For any questions regarding the licensing requirements, please contact our Sales or Support team. Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 5 of 27

6 How to Prepare Your Azure Environment for Docusnap This chapter describes the preparation steps to be carried out in Microsoft Azure to perform an inventory with Docusnap. The Docusnap Azure Inventory dialog prompts you for multiple IDs. These IDs are assigned during the preparation in Azure. We recommend that you save the values in a text editor to have them at hand when you are prompted to enter them in the Azure Inventory Wizard. 2.1 Overview of the Preparations in Azure Create and register the new Docusnap Inventory application and save the application ID Create the application key and save the key value Authorize the application Authorize the application for the desired subscriptions Save the directory ID of the Azure Active Directory Fig. 1 Azure preparations for Docusnap X 2.2 Azure Preparations Required Permission Before you start, make sure that you can log on as an Azure user who has global administrator rights. Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 6 of 27

7 2.3 Creating the New Docusnap Inventory Application For the Docusnap Azure Inventory feature, a registered application is required. This application must have read access to the Microsoft Azure data. This section describes how to create such an application. In our example, the application is called Docusnap Inventory. You can choose any name you like, but it is recommended to enter a meaningful name. To grant the Docusnap Azure Inventory feature read access to the Windows Azure Service Management API, you need to create a new application of the Web App / API type Opening the New application registration dialog Select the Azure Active Directory item from the resource list at the left In the Azure Active Directory view, select the App Registrations item under Manage Click the New Application Registration menu item Fig. 2 Creating an application Opening the New Application Registration dialog Creating the Docusnap Inventory application You now create the Docusnap Inventory application in the Create dialog. Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 7 of 27

8 Name field: Enter Docusnap Inventory as the application name Application Type field: Select the Web app / API type Sign-on URL field: Enter the URL here Create: Click this button to create the Docusnap Inventory application Fig. 3 Creating the application Creating the Docusnap Inventory application Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 8 of 27

9 2.3.3 Determining the application ID and saving it for the Docusnap scan dialog When you have completed the creation process, the application will be displayed along with its Application Name, Application Type, and its Application ID in the Dashboard. Change to the application by clicking its name in the application view. Now, copy the application ID to your text editor. This value will later be needed for the inventory scan. With the focus on the ID, a copy symbol is displayed automatically. You can use it for copying. Fig. 4 Creating the application Copying the application ID to the text editor Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 9 of 27

10 2.3.4 Opening the application settings After copying the ID, click the Display Name. This opens an overview of your application. Now, click the Settings button to open the Settings dialog. There, select the Keys option in the API Access category. Fig. 5 Creating the application Accessing the settings Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 10 of 27

11 2.3.5 Creating the application key and saving it for the Docusnap scan dialog Now, create a key for the Docusnap Inventory application and enter a meaningful name in the Description field. Then, select the validity period in the Expires field. For this example, we entered the following values: Description field: DS Inventory Key Expires field: Two years (here: January 25, 2020) Save: Click the Save button at the upper left The key is displayed one single time in the Value field. Copy the key value to your text editor Note: If you lose the key value or if it becomes invalid, you need to create a new key. Fig. 6 Creating the application Creating and saving the key Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 11 of 27

12 2.3.6 Authorizing the Docusnap Inventory application Now, the next step is to authorize the Docusnap Inventory application for the Windows Azure Service Management API. Select the Required Permissions option from the API Access group in the right-hand panel Click Add in the Required Permissions panel In the first step, you need to select an API. Click 1 Select an API Select Windows Azure Service Management API and then click Select The Enable Access panel opens. Under Delegated Permissions, click Access Azure Service Management as organization users (preview) o o Now, click Select o Click Done to confirm Now, the required permissions are set and the API column in the right panel shows Windows Azure Service Management API (see screenshot) Fig. 7 Authorizing the Docusnap Inventory application Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 12 of 27

13 2.3.7 Authorizing the Docusnap Inventory application for all desired subscriptions Now, you will grant the Docusnap Inventory application read access to the Windows Azure Service Management API. This step shows you how to navigate to the Access Control (IAM) function. Click the Subscriptions item in the left panel Select the desired subscription (in this example, we selected Docusnap Prod ) In the subscription list, click Access Control (IAM) Click the Add button at the top right Fig. 8 Creating an application Opening Access Control (IAM) Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 13 of 27

14 2.3.8 Assigning the Reader role to the Docusnap Inventory application per subscription Under Select a Role, click Reader In the Select field, enter Docusnap. Now, the Docusnap Inventory application should be selectable Click the Docusnap Inventory application Now, the application is listed under Selected Members Click Save to confirm the assignment After you have completed the assignment, the Docusnap Inventory application should be listed with the Reader role assigned Fig. 9 Creating the application Assigning the Reader role to the application Note: Repeat the steps described in sections and for every subscription to be inventoried with Docusnap. Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 14 of 27

15 2.4 Azure Active Directory Determining the Directory ID Determining and saving the directory ID Select the Azure Active Directory item from the resource list at the left In the Azure Active Directory view, select the Properties item under Manage Use the copy function to save the Directory ID shown in your text editor Fig. 10 Azure Active Directory Determining the directory ID Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 15 of 27

16 2.5 Summary The changes made up to now enable you to inventory your Microsoft Azure Cloud application with Docusnap. Docusnap will use the Docusnap Inventory application to inventory the desired information through the API and store it for further processing in the Docusnap database. Your text editor should now contain all the values saved in-between. These are required for the subsequent inventory process. (Parts of the keys were anonymized in this example.) Fig. 11 Text editor with all required data Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 16 of 27

17 Inventorying the Azure Cloud with Docusnap 3.1 Docusnap Azure Inventory Wizard Prerequisite: proxy configuration If your network uses a proxy, you must specify the proxy parameters in the connection settings. It is possible that you normally do not need these settings when using the other scan modules. Basically, the proxy settings must be suitable for the respective DDS (Docusnap Discovery Service). The settings shown in the exemplary screenshot are suitable for interactive Azure inventory scans. If you selected the Discovery Service of another location as the DDS, you would have to adjust the proxy settings for this DDS installation. Adjusting the proxy settings: Click Docusnap in the upper left corner to open the Options panel Select the General Options item from the list of options In the Options dialog, click Connections. Under Proxy Settings: o select Set up manually o Under Address, enter your proxy URL including the Port number o Enter suitable values in the User and Password fields Click OK to confirm your changes Fig. 12 Manually entering proxy settings in the Docusnap option dialog Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 17 of 27

18 3.1.2 The Docusnap Azure Inventory scan dialog Starting the Azure Inventory wizard The Docusnap ribbon has been extended: we added the Cloud Services group. Click Azure to open the scan dialog. Fig. 13 Azure Inventory scan dialog Starting the wizard Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 18 of 27

19 3.1.4 Azure scan dialog Company Selection In the first step, select the company the Azure scan result will be assigned to. Alternatively, you can click Create new Company to create a new company (tenant). Multi-tenant capability is only available in the Docusnap X Ultimate Edition. Fig. 14 Azure Inventory scan dialog Company Selection Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 19 of 27

20 3.1.5 Azure scan dialog Domain Selection In the Domain Selection step, select the domain of the previously selected company the scan result will be assigned to. Alternatively, you can create a new domain for the selected company by clicking Create new Domain. In addition, you need to specify a Discovery Service for performing the inventory scan. In this example, the Docusnap Server has been configured and was selected for the scan. Other DDS installations are not available here. If you select the Client Discovery Service, it is not possible to run the scan as a scheduled job. In this case, the wizard will warn you accordingly. Fig. 15 Azure Inventory Domain Selection Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 20 of 27

21 3.1.6 Azure Inventory Now, you need the previously collected IDs and key information that you saved in your text editor. The Display Name is only a placeholder and can therefore be chosen freely The Directory ID corresponds to the ID of your Azure Active Directory For the Application ID, enter the ID of the application you created previously In the Key field, enter the value of the key you created previously Selecting subscriptions All existing subscriptions are displayed in the Subscriptions panel and selected by default. You can deselect them as required. Please note that your Azure application must have been authorized for each selected subscription Completing the Azure scan settings Finally, click Save. If Docusnap reports a proxy error, refer to the Prerequisite: proxy configuration section in this chapter. Fig. 16 Azure Inventory Entering Azure scan information Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 21 of 27

22 3.1.9 Azure scan dialog Naming the snapshot, summary and schedule You can optionally assign a meaningful name to the snapshot of the Azure scan in the Name Snapshot step. After displaying a Summary of the scan to be conducted, Docusnap offers you to perform this scan as a one-time or recurring scheduled job provided you selected a suitable DDS. If you scheduled an inventory scan, the wizard completes after you have clicked Finish and the scan job is listed in Job Management. If you have chosen to run the scan interactively, it will start immediately once you click Finish. Fig. 17 Azure Inventory Optional scheduling, completing the wizard Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 22 of 27

23 3.2 Azure Scan Result in Docusnap The scan result will be displayed as a separate node called Azure in the Inventory module, below the previously selected domain within the infrastructure of the respective company. The screenshot shows the top levels of an Azure test environment: Fig. 18 Display of the Azure cloud in Docusnap Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 23 of 27

24 3.3 Azure Report You can display an overview report of your Azure cloud by clicking Azure Overview below the Azure data (see Fig. 18). Before Docusnap generates the report, a dialog appears where you can optionally select the following Azure resources: Virtual computers Store accounts Computers with an SQL Server SQL databases Fig. 19 Azure Overview report Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 24 of 27

25 LIST OF FIGURES FIG. 1 AZURE PREPARATIONS FOR DOCUSNAP X... 6 FIG. 2 CREATING AN APPLICATION OPENING THE NEW APPLICATION REGISTRATION DIALOG... 7 FIG. 3 CREATING THE APPLICATION CREATING THE DOCUSNAP INVENTORY APPLICATION... 8 FIG. 4 CREATING THE APPLICATION COPYING THE APPLICATION ID TO THE TEXT EDITOR... 9 FIG. 5 CREATING THE APPLICATION ACCESSING THE SETTINGS...10 FIG. 6 CREATING THE APPLICATION CREATING AND SAVING THE KEY FIG. 7 AUTHORIZING THE DOCUSNAP INVENTORY APPLICATION...12 FIG. 8 CREATING AN APPLICATION OPENING ACCESS CONTROL (IAM)...13 FIG. 9 CREATING THE APPLICATION ASSIGNING THE READER ROLE TO THE APPLICATION FIG. 10 AZURE ACTIVE DIRECTORY DETERMINING THE DIRECTORY ID...15 FIG. 11 TEXT EDITOR WITH ALL REQUIRED DATA...16 FIG. 12 MANUALLY ENTERING PROXY SETTINGS IN THE DOCUSNAP OPTION DIALOG FIG. 13 AZURE INVENTORY SCAN DIALOG STARTING THE WIZARD...18 FIG. 14 AZURE INVENTORY SCAN DIALOG COMPANY SELECTION...19 FIG. 15 AZURE INVENTORY DOMAIN SELECTION FIG. 16 AZURE INVENTORY ENTERING AZURE SCAN INFORMATION...21 FIG. 17 AZURE INVENTORY OPTIONAL SCHEDULING, COMPLETING THE WIZARD FIG. 18 DISPLAY OF THE AZURE CLOUD IN DOCUSNAP FIG. 19 AZURE OVERVIEW REPORT Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 25 of 27

26 VERSION HISTORY Date Description January 25, 2018 Version 1.0 completed Inventorying Microsoft Azure 2018 Docusnap All rights reserved Page 26 of 27

27 itelio GmbH -