Applies to BloodHound Enterprise only

​
Create the AzureHound Enterprise app

  1. Log into the Azure portal as a Global Admin or a Privileged Role Admin.
  2. From the Azure portal menu, search for or select Microsoft Entra ID
  1. In the left menu, select App registrations
  1. Click New registration
  1. In the Name field, give the application an identifying name in your organization. Make sure the supported account type is set to the “Accounts in this organizational directory only (Single tenant)” option. A URI is not required. Then click “Register”
  1. In the Overview menu, copy the Application (client) ID and Directory (tenant) ID to be used later in AzureHound Enterprise Local Configuration
  1. Continue the next section: “Grant Microsoft Graph Permissions”

​
Grant Microsoft Graph Permissions

  1. In the AzureHound application, select API Permissions
  1. Select Add a permission
  1. Click on Microsoft Graph
  1. Select Application permissions
  1. Search for the permission: “Directory.Read.All”, and check the box next to it
  1. Search for the permission: “RoleManagement.Read.All”, and check the box next to it
  1. In the bottom of the window, select Add permissions
  1. Click on “Grant admin consent for <your_tenant_name>”.
  1. Click “Yes” on the confirmation dialog.
  1. After being redirected to API Permissions again, select Grant admin consent for <your_tenant_name>
  1. Continue to the next section: “Grant “Directory Reader” role on the Azure tenant”

​
Grant “Directory Reader” role on the Azure tenant

  1. Click on the hamburger menu button, then select Microsoft Entra ID to return to the tenant view.
  1. Select Roles and administrators
  1. Search for the role “Directory Readers” and click the role name or description _Note: Clicking the checkbox sometimes prevents clicking on the role itself.
_ 4. In the “Directory readers” role, select Add assignments
  1. Click “No member selected” to open the search window.
  1. Search for the previously created service principal with either its name, application ID, or object ID. Select it by clicking on it
  1. Click Select
  1. Validate that your principal is displayed and click Next
  1. Ensure that the Assignment type is “Active” and the “Permanently assigned” box is checked. Provide a justification and click “Assign”.
  1. Confirm the service principal is a Directory Reader by refreshing this view.
  2. Continue to the next section to provide Directory Reader permissions on your subscriptions.

​
Grant “Reader” role on all subscriptions

Note: If you do not have any management groups, you may either create your Tenant Root Group following the prompts in the middle of the screen to ensure future visibility if another administrator begins use of subscriptions, or you may skip this section altogether. If you skip this section, you will see a warning in the logs for each collection indicating the lack of ability to collect this data accordingly.
  1. Search for and select the “Management groups” item in the top search bar
  1. Select Tenant Root Group
  1. Select Access control (IAM)
  1. Select Role assignments
  1. Click Add, then Add role assignment
  1. Find the “Reader” role and select it
  1. Click “Members”.
  1. Click Select members
  1. Search for and click on your previously created service principal.
  1. Validate the principal selected, then click Select
  1. Click the tab Review + Assign
  1. Click Review + Assign at the bottom of the page
  1. Confirm the role is present by refreshing this view. You may need to alter the filter to see this role.
  2. Continue to the next section: “Add certificate to Azure for Authentication”

​
Add certificate to Azure for Authentication

This section requires you have authentication material. We highly recommend using certificate-based authentication. If you do not already have a certificate created, follow the article AzureHound Enterprise Local Configuration and then return back here.
  1. Log into the Azure portal as a Global Admin or a Privileged Role Admin.
  2. Search for or click on Microsoft Entra ID
  1. On the left, click “App registrations”.
  1. Search for and click on the Application you created previously.
  2. Click on Certificates & secrets
  1. Click on “Certificates”.
  1. Click “Upload certificate”.
  1. Locate the “cert.pem” file created during AzureHound setup (either on your own, or utilizing the instructions at AzureHound Enterprise Local Configuration)
  2. Click the folder icon and locate the “cert.pem” file. Add a description if desired.
  1. In the bottom of the window, select Add
  2. Continue to Run and Upgrade AzureHound (Windows, Docker, or Kubernetes)