...
CyberCNS features out-of-the-box Azure AD Integration support. Simply enter Azure AD credentials and get the Azure AD statistics to help analyze the network.
Azure AD Legacy supports DAP whereas the new Azure AD integration supports GDAP as well.
With Azure AD Legacy we have automatic application creation which uses write API’s.
Azure AD Legacy
Select Integration
| Info |
|---|
|
...
It will lead to add credentials for your Azure AD Legacy Instance. Provide details as requested.
Enter Azure AD Legacy Credentials
Click on + to add Azure AD Legacy credentials.
Choose a name for the credentials and Save.
...
Once the login is successful, the Azure AD Credentials will be stored successfully. It is possible to add multiple credentials. A user having a Global Administrator role is required to be added.
Company Mapping
| Info |
|---|
If a company has already integrated Azure AD with any tenant, then when the same company is integrated with new Azure AD, the old integration mapping for this company is removed. |
...
There is an option to Delete the integration mapping using the Action column. Any company mapping can be deleted if needed.
...
Azure AD
Navigate to Global Settings(⚙) > Integrations and choose Azure AD from the integrations listed here.
...
Enter Azure AD Credentials
Click on + to add Azure AD credentials.
Choose a name for the credentials and Save.
To get the Client ID, Tenant ID, and Client Secret please follow the below steps:
In the Microsoft Azure portal, navigate to App registrations > New registration.
...
Choose the supported account types as Single tenant or Multitenant.
...
Copy the Application (Client) ID and Directory(Tenant) ID from here to be provided into the CyberCNS portal under Azure AD Integration.
...
Create a New Client Secret for this application.
Provide a description for this new client secret and click on Add.
...
Once added an auto-generated Value will be seen. Copy this Value and use it as a Client Secret into CyberCNS Portal.
...
Below are the permissions required for Non-CSP account. Make sure to have these API permissions in place.
...
Once all required details are added into CyberCNS, click on Save.
...
On clicking the Save option, the redirection to Microsoft Sign in page is seen.
...
Once the login is successful, the Azure AD Credentials will be stored successfully. It is possible to add multiple credentials.
A user having a Global Administrator role/permissions is required to be added.
...
| Info |
|---|
If a company has already integrated Azure AD with any tenant, then when you integrate the same company with new Azure AD, the old integration mapping for this company is removed. |
The next step is to map local companies in CyberCNS to Azure AD companies corresponding to the selected Azure AD credentials.
...
In New Company Mapping, choose the Azure AD Credential of your choice from the dropdown and click on +Add to map the company.
One of these two options could be selected
🔸 Import Companies from Azure AD:- To import multiple companies at a time.
🔹 Map Existing Company to an Azure AD company:- To map an existing company to the Azure AD company.
...
To import multiple companies from Azure AD, choose Import Companies from Azure AD, and click on Next.
...
Multiple companies can be added to the user interface so the Azure AD data to be synced to appropriate companies selected.
...
Now click on Finish to import all the selected Azure AD companies.
...
There is an option to Delete the integration mapping using the Action column. Any company mapping can be deleted if needed.
...
As shown in the below image, select the Existing company and Azure AD company by using a dropdown or with the search bar as per the requirement.
...
Once the company is selected click on ‘+' to select the company and click on Finish to map all the selected Azure AD companies.
...
There is an option to Delete the integration mapping using the Action column. Any company mapping can be deleted if needed.
...
| Info |
|---|
|
Azure Active Directory
At the Company Level, Navigate to Azure Active Directory to get the details such as Active Directory Users, Active Directory Computers, Active Directory Role Assignments, Active Directory Groups, and Active Directory Audit Logs.
...
3. In the Azure Active Directory Groups, the details like Display Name, Mail, Group Types, Is Mail Enabled, Proxy Addresses, Resource Behavior Options, Security Enabled status & Security Identifier are seen.
...
4. In Azure Active Directory License, the details like License Friendly Name, SKU Part Number, Active Units, Consumed Units, Warning Units & Suspended Units are seen.
...
6. In Azure Active Directory Logs, the details like Activity Display Name, Category of the activity, Result, Result Reason, Logged by Service, Correlation id, Activity Initiated by User & Initiated from IP are seen.
...
Microsoft Secure Score
Microsoft Secure Score is a numerical summary of security posture based on system configurations, user behavior, and other security-related measurements; it is not an absolute measurement of how likely your system or data will be breached.
...
In the depicted below image using the search filter option (
) can search the Score Breakdown based on the requirement.
...
CSP
| Info |
|---|
For CSP account, Please follow the steps for Azure AD integration with MS Azure portal and verify once. |
...
Once you enter the credentials, it will register the application with Microsoft. On successful registration, it will populate the data to the CyberCNS portal under the company you have mapped it. It takes approx 15 mins to get registered with Microsoft.
...
Non-CSP
| Info |
|---|
Non CSP account, Please follow below steps for Azure AD integration. |
...
Step 5: Please wait for 10 to 15 minutes after the consent. Microsoft takes time to approve the application. After the approval, the data should be populated in the CyberCNS portal.
Troubleshooting
Troubleshooting Case 1: No data
While signing in to your Microsoft account, Permission is granted by enabling the checkbox “Consent on behalf of your organization”.
CSP Users
For CSP users follow the below steps to troubleshoot the issue
Replace the customerid with Azure tenant ID in the below URL
https://login.microsoftonline.com/{customerid}/v2.0/adminconsent?client_id=41347456-8f58-4bee-9a3a-0f5708b7212f&scope=offline_access%20Organization.Read.All%20User.Read%20AccessReview.ReadWrite.All%20email%20Reports.Read.All%20SecurityEvents.Read.All%20Directory.AccessAsUser.All%20Directory.ReadWrite.All%20openid%20profile%20User.ReadWrite.All%20Group.ReadWrite.All%20SecurityEvents.ReadWrite.All%20AuditLog.Read.All&redirect_uri=https://authccns.mycybercns.com&state=12345 log in login with your customer administrator account and accept all the steps wait for some time to see populated data.
Non-CSP Users
For Non-CSP users follow the below steps to troubleshoot the issue
If the consent has not enabled the checkbox before sign in to your Microsoft Account, follow the steps below
login to Microsoft Azure portal https://portal.azure.com
Click on Enterprise Applications -> Search for your Tenent in the overview
In the Enterprise Applications, Click on All Applications → Click on CyberCNS Application
After clicking on CyberCNS click on Properties → Delete the application .
Navigate to Global Settings(⚙) > Integrations and choose Azure AD from the integrations listed here.
It will lead you to add credentials for your Azure AD Instance. Provide details as requested. Enter Azure AD Credentials
Click on + to add Azure AD credentials.
Choose a name for the credentials and Save.
...
Once the Permission request is accepted user will get the message as “Grant admin consent for CyberCNS-Admin consent was successfully added” as shown below and the user will get redirected to the CyberCNS page.
...
Login to CyberCNS and follow the below steps to map the company.
As shown in the below image, select the Existing company and Azure AD company by using a dropdown or with the search bar as per the requirement.
...
Once the company is selected click on ‘+' to select the company and click on Finish to map all the selected Azure AD companies.
...
Troubleshooting Case 2: Azure Token expired
| Info |
|---|
|
...
This completes Azure AD Integration.
Troubleshooting Case 3: Azure AD scan failure
Once the scan is initiated, the User can check in the jobs sections → Azure Active Directory Jobs.
Since the user will not have the privilege to access, If the AD scan is failed for CSP and Non-CSP users, Follow the steps below
CSP Users
For CSP users follow the below steps to troubleshoot the issue
Replace the customerid with Azure tenant ID in the below URL
https://login.microsoftonline.com/{customerid}/v2.0/adminconsent?client_id=41347456-8f58-4bee-9a3a-0f5708b7212f&scope=offline_access%20Organization.Read.All%20User.Read%20AccessReview.ReadWrite.All%20email%20Reports.Read.All%20SecurityEvents.Read.All%20Directory.AccessAsUser.All%20Directory.ReadWrite.All%20openid%20profile%20User.ReadWrite.All%20Group.ReadWrite.All%20SecurityEvents.ReadWrite.All%20AuditLog.Read.All&redirect_uri=https://authccns.mycybercns.com&state=12345 log in login with your customer administrator account and accept all the steps wait for some time to see populated data.
Even after enabling consent for all the users, If the consent is not enabled for the customer:
Login to Microsoft account using customer tenant global admin credentials and accept the consent.
Non CSP Users
For Non-CSP users follow the below steps to troubleshoot the issue
If the consent has not enabled the checkbox before sign in to your Microsoft Account, follow the steps below
login to Microsoft Azure portal https://portal.azure.com
Click on Enterprise Applications -> Search for your Tenent in the overview
In the Enterprise Applications, Click on All Applications → Click on CyberCNS Application
After clicking on CyberCNS click on Properties → Delete the application .
Navigate to Global Settings(⚙) > Integrations and choose Azure AD from the integrations listed here.
It will lead you to add credentials for your Azure AD Instance. Provide details as requested. Enter Azure AD Credentials
Click on + to add Azure AD credentials.
Choose a name for the credentials and Save.
On clicking the Save option is clicked, Users are redirected to sign in to the Microsoft account.
Once the login is successful, the Azure AD Credentials will be stored. It is possible to add multiple credentials. user needs to log on with a user having a Global Administrator role.
If data is not populated check in the Microsoft Azure portal in CyberCNS permissions, the type of permissions to be granted for an Admin account or User account. Click on “Grant admin consent”.
Click on “Accept“ permission
Once the Permission request is accepted user will get the message as “Grant admin consent for CyberCNS-Admin consent was successfully added” as shown below and the user will get redirected to the CyberCNS page.
Login to CyberCNS and follow the below steps to map the company
As shown in the below image, select the Existing company and Azure AD company by using a dropdown or with the search bar as per the requirement.
Once the company is selected click on ‘+' to select the company and click on Finish to map all the selected Azure AD companies.
Even after enabling consent for all the users, If the consent is not enabled for the customer:
...