Skip to main content
View this page as a PDF

​
Overview

A Service Principal is an identity created within your on-premises Active Directory (AD) and that is allowed to access one or more resources within your AD. You can delegate the minimum required permissions to the service principal so that it can be used to create a connection to Densify to collect data.
Azure Stack is not supported. This data collection method currently only supports Azure Cloud.
If you are using a standalone Azure Active Directory account (i.e. an Azure AD), then see Microsoft Azure Data Collection Prerequisites on page 1. The Service Principal possesses the following characteristics:
  • An application that is created within your . This application will be associated with the user that creates it.
  • A service principal is then created for that application;
  • The service principal is granted access to your Azure subscription.
The following procedure allows you to use a federated Microsoft Entra ID account to create a cloud connection to Densify. In this case a Service Principal is required to connect Densify to your Azure subscriptions.
In this case “federated” indicates that your on-premise Active Directory is linked with your Azure Cloud’s Entra ID so you can use your existing on-premise AD credentials to access your Azure portal.

​
Requirements to Create a Cloud Connection

To connect Densify to your Azure subscriptions, you need the following items to setup data collection: Additionally, the application must be assigned the role of “Reader” for each of the subscriptions from which data will be collected. The Reader role is sufficient for resource utilization data.

​
Required Account Permissions

You must have admin/owner privileges for your Azure portal to create the account required for Densify. Typically, your on-premise Active Directory is federated with the Azure AD. In this case, the admin access is likely provided from an on-premise Active Directory account (via federation) and will possess the required Azure admin privileges. The user account/Service Principal to be used for data collection only requires the “Reader” role privileges to collect resource utilization data. If necessary you can configure a custom role that is more restrictive than the “Reader” role privileges. See Configuring a Role with Minimum Permissions for Data Collection for details.

​
Obtaining the Tenant ID/Directory ID

The tenant ID corresponds to the Microsoft Entra ID.
  1. Login into your Azure account and click on Microsoft Entra ID> Overview .
  2. In the Overview pane, copy the Tenant ID.

​
Obtaining the Application ID and Client Secret

You now need to create a new application registration. This will be the service principal for Densi. You will need the Application ID and corresponding client secret (key), to complete the Densify connection.
  1. Click App Registration.
  2. In the App Registration pane, click New registration.
  1. In the Create pane enter the following information:
  • The Name of the application (e.g. Densify_Connection).
  • Select who can access the application. Leave the default of “Accounts in this organizational directory only (Default Directory only - Single tenant)”.
  • Select the Redirect URI (optional) as “Web” and specify a Sign-on URI (e.g. https://Densify.com).
The Register button becomes available once you enter valid data.
  1. Click Register to create and register the application. This is the service principal that Densify will use to collect data.
  1. Copy the Application ID (e.g. 7d16fbf8-1fc3-4e08-b48a-626). You need to copy this ID and save it to a location from which you can easily retrieve it. You will need the Application ID to create the Densify connection.
  1. Click Client credentials to see create the credential.
  2. Click on New client secret to create a new key.
  3. In the Add a new client secret pane, enter a Description (e.g. DensifyKey) and an expiration period (e.g. 1 year, 2 years or never expires).
  4. Click Add to create the key.
  5. Copy the secret key Value to a location from which you can easily retrieve it. You will need this key to create the Densify connection.

​
Obtaining the Subscription ID

If you are using the API, data collection and analysis are created and then refreshed daily on a per subscription basis (1-to-1). You can associate many subscriptions with a service principle, but when using the API to initiate data collection, you must specify a subscription ID and the audit and analysis are created for each subscription, separately. When using the Connection Wizard in the Densify UI, you do not need the subscription ID, as all subscriptions that are associated with the service principle are collected and listed once the connection has been verified. You can then select one or more of the subscriptions that you want to analyze (1-to-Many). When using the Connection Wizard, data collection and analysis are created and then refreshed daily for all of the subscriptions that you selected when you created the connection. Use the following instructions to get the Subscription ID.
  1. Navigate to Subscriptions in the main menu. You may need to click on More services to see Subscriptions.
  2. Click on a subscription to open the configuration page.
  3. Copy the Subscription ID. You need to copy this ID and save it to a location from which you can easily retrieve it. You will need the Subscription ID to initiate data collection, when using the Densify API.

​
Assigning Access to Subscriptions

The application registered above, now needs access to each of your subscriptions. You need to assign the “Reader” role to the Application for each subscription being audited. Use the following process:
  1. Navigate to Subscriptions in the main menu. You may need to click on All services to see Subscriptions.
  2. Click on a subscription to select and open the configuration pane.
  1. Click Access Control (IAM).
  2. Click Add > Add role assignment.
  1. In the Add role assignment pane select the Role of “Reader”.
  2. Click Next .
  1. On the Add role assignment pane, ensure Assign Access to is set to “User, group or service principal”.
  2. Click Select members.
  3. Search for or scroll to locate the service principle (Densify_Connection), created above.
  4. Click Select.
  1. The selected application will appear in the Members section.
  2. Click Review + Assign to save these changes.
  1. Repeat this process for each subscription to be included in Densify data collection.
Once the account has been configured you can use the tenant ID, application ID and secret key to create the cloud connection as outlined in Using the Public Cloud Connections Wizard.

​
Advanced Topics

The following sections contain detailed instructions for more advanced configuration. Some sections are referenced in the procedures above. Other advanced topics cover optional configuration.

​
Configuring a Role with Minimum Permissions for Data Collection

To simplify setup and maintenance of the role used for performing data collection, Densify recommends using the “Reader” role. This role provides read-only access to your Azure services and resources and supports the requirements for resource utilization data collection. As the Densify continues to evolve and expand, you do not need to update permission policy to include newly added services and features, when using the “Reader” role. Alternatively, if you must restrict the role with the minimum permissions you can create a custom role with only the required permissions. These custom roles provide an alternative method for granting permissions that are more restrictive than the built-in “Reader” role. These custom roles (JSON) define the minimum permissions required by Densify to collect resource utilization metrics data, respectively. The “Densify Resource Utilization Metrics Reader” custom role grants read-only permissions for collecting data related to VMs, SQL servers and reservations in the subscriptions specified in the assigned scope. Custom Role: Densify Resource Utilization Metrics Reader 
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

{<br/>    "properties": {<br/>        "roleName": "DensifyResourceUtilizationMetricsReaderCustomRole",<br/>        "description": "This custom role defines the minimum read-only permissions required by Densify for collecting data related to VMs, SQL servers and reservations associated in the subscriptions specified in the assigned scope",<br/>        "assignableScopes": [<br/>        ],<br/>        "permissions": [<br/>            {<br/>                "actions": [<br/>                    <br/>                    "Microsoft.Capacity/appliedreservations/read",<br/>                    "Microsoft.ClassicCompute/virtualMachines/read",<br/>                    "Microsoft.Compute/virtualMachines/read",<br/>                    "Microsoft.Compute/virtualMachines/instanceView/read",<br/>                    "Microsoft.Compute/virtualMachineScaleSets/read",<br/>                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",<br/>                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read",<br/>                    "Microsoft.Insights/AutoscaleSettings/Read",<br/>                    "Microsoft.Insights/eventtypes/values/read",<br/>                    "Microsoft.Insights/Metrics/read",<br/>                    "Microsoft.Insights/MetricDefinitions/read",<br/>                    "Microsoft.Network/networkInterfaces/read",<br/>                    "Microsoft.Network/networkSecurityGroups/read",<br/>                    "Microsoft.Network/virtualNetworks/read",<br/>                    "Microsoft.Resources/subscriptions/read",<br/>                    "Microsoft.Resources/subscriptions/resourceGroups/read",            <br/>                    "Microsoft.Sql/servers/databases/read",<br/>                    "Microsoft.Sql/servers/elasticPools/read",<br/>                    "Microsoft.Sql/servers/read"                <br/>                    <br/>                ],<br/>                "notActions": [],<br/>                "dataActions": [],<br/>                "notDataActions": []<br/>            }<br/>        ]<br/>    }<br/>}
Use the following instructions to create the custom roles:
  1. Copy the above sample and save it as JSON files.
  2. Login into your Azure account. You must have admin or owner privileges for your Azure portal. See Microsoft Azure Data Collection Prerequisites for a Service Principal.
  3. Navigate to Subscriptions in the main menu. You may need to click on All services to see Subscriptions. Select a subscription.
  4. Click Access Control (IAM).
  5. Click Add > Add custom role.
  6. In Create a custom role, select Start from JSON and then select one of the custom role JSON files, that you saved above. The role name and description fields are populated with details from the JSON file. The file will also be validated.
  7. Click Next and review the list of permissions.
  8. Click the Assignable scope tab and select subscription as the Type. Select the subscriptions to which the custom role will be assigned.
  9. Click the JSON tab to review your settings and then create the custom role and click Save.
  10. Assign the custom role to the Densify service principal. See Assigning Access to Subscriptions.

​
Create the Service Principal Through the Azure CLI

If you are comfortable working with the command line, you can create the service principle through the Azure CLI. You can then use the resulting .JSON file when working with the Densify API. Refer to the Azure website for details: Create an Azure service principal with the Azure CLI.

​
Creating the Cloud Connection in Densify

Once all of the prerequisites are complete, you can create the cloud connection through the Cloud Connection wizard. See Using the Public Cloud Connections Wizard.

​
Modifying Your Azure Cloud Connection

When you create the Azure cloud connection for the first time, Densify discovers all of the subscriptions, associated with the user or service principal. Upon saving the connection it will schedule data collection from each of the discovered and selected subscriptions. If subsequently, subscriptions are added, they will not be included in data collection. Additionally, subscriptions that are removed will continue to be included, resulting in wasted time and resources. To add new subscriptions or remove old ones, edit the cloud connection. See Editing a Connection.