Overview

The Censys Cloud Connector for Azure enumerates your cloud environment, ensuring that Censys Attack Surface Management (ASM) is always up to date so your security teams are working with the most current data. This integration scans each resource to determine whether it is public. 

Data refresh frequency

Cloud Connectors refresh more often than other connections. After you set up Cloud Connectors, your data will refresh as often as every 4 hours. 

To see the latest refresh time in Censys ASM, click Integrations in the top navigation menu, then view the date within the Cloud Service Provider card.

How to configure the Censys Cloud Connector for Azure

There are two options for configuring Censys Cloud Connectors for Azure: using the Censys ASM UI, or via the Censys API.

Prerequisites

You will need the following before you get started:

• Your Azure tenant ID
• Your Azure management group ID(s)
• Your Azure subscription ID(s)
  • We recommend the tenant root group ID
• Optionally, you may need:
  • A list of management groups or subscriptions you wish to exclude from being sent to Censys ASM

The following users and permissions are required:

• Censys ASM user with the workspace role "Manager"
• Azure Admin with the following:
  • Permissions to create IAM Resources at the Management Group level
  • Permission to create a Service Principal with the Reader role
  • Ability to authorize an Enterprise Application to the tenant

These are the least privileged permissions required to access your cloud resources and import them into Censys.

Option 1: Configuring the Cloud Connector in the Censys UI

Step 1: Configure the integration in Censys

1. Log in to Censys ASM, then click Integrations at the top of the page.

2. Locate Azure and click Set Up. 

3. In the setup wizard, configure the following:

   • Tenant ID: Enter a tenant ID or use the default name.

   • If you are including an Azure tenant:
     • Select Management Group ID and enter the ID into the field.
       
   • If you are including a standalone Azure Subscription:
     • Select Subscription ID and enter the ID into the field.
       

   • Excluded Fields: Optionally, enter any resource types or subscription IDs you wish you exclude from being sent to Censys ASM.

4. Click Next Step.

5. On the IAM Resource page, your Custom Role Name is displayed. You will need this in the next steps. Click Admin Consent.

   • You will be redirected to Azure.

Step 2: Configure the role in Azure

1. Log in to Azure. A permissions screen will appear for Censys. Click Accept on the permissions screen.  
   
   
   • After you accept the permissions, the enterprise application will be installed within your tenant. Return to Azure to view your enterprise applications list to ensure that it has been installed. 
2. Navigate to Management groups, then click the name of the management group you wish to use for this integration.
3. On the left side of the page, click Access control (IAM).
   • If you configured your scope to be the entire tenant, you will configure the IAM access control at the root group. If you have included multiple management groups, you will need to follow these steps to configure this for each group or subscription included in your scopes.
4. In the top left, click +Add then click Add custom role.
   
   
5. Configure the form:
   • Custom role name: Enter the Cloud Connector ID from your Censys ASM.
   • Description: Optionally, enter a description.
   • Baseline Permissions: Select Clone a role.
   • Role to clone: Select Reader.
6.  Click Review and Create, then click Create.
   • You will see a success message. Click OK in the message, then you will be redirected to Access control (IAM).
7. In the top left, click +Add then click Add role assignment.
8. Search for your Cloud Connector ID and select it.
9. Click the Members tab. Next to the Members field, click +Select members.
10. Search for "Censys Hosted." Click the Censys Hosted Cloud Connector, then click Select. 
11. Next to Assign access to, select User, group, or service principal. 
    
    
12. Click Review and Assign, then click Review and Assign again.

Step 3: Finish the integration in Censys

1. Return to Censys ASM.
2. Click Next Step, then click Done.

Option 2: Configuring the Cloud Connector via the Censys API

Step 1: Creating the hosted connector using Censys API

1. Craft a JSON body with the appropriate scopes describing how you want the Hosted Cloud Connector to scan your AWS environments. Any combination of Organizations and standalone accounts is acceptable.
   • To include an Azure tenant, provide the Tenant ID, the Management Group ID, and any optional Subscription or service type exclusions.
   • To include a standalone Azure Subscription, provide the Tenant ID, the Subscription ID and any optional service type exclusions.
   • For examples, see the JSON Examples section below.
2. When your JSON body is ready, create a new hosted connector using the Censys Hosted Connectors API endpoint.
   1. Navigate to the Integrations Marketplace.
   2. Copy your API Key to your clipboard.
   3. Follow the link to API Documentation.
   4. Click Authorize and paste in your API key. Click Authorize > Close.
   5. Expand the hosted connectors header to expose the Hosted Connector endpoints.
   6. Expand the POST /v1/hosted-connectors endpoint.
      1. Click Try it out, then replace the example value with your own JSON body.
      2. Click Execute.
3. Censys will return a response body that includes an adminConsentUrl per Tenant provided. Use these URLs to add the Censys Cloud Connector Enterprise Application to each Tenant that the Cloud Connector will scan.

 Step 2: Deploying in Azure

1. For each Management Group and Subscription provided as a scope, create a Custom role and Role assignment.
   1. Copy the ID of the Hosted Connector from the response body and use it as the Custom Role Name.
   2. Navigate to Access Control (IAM). 
   3. Click +Add then click Add custom role. Configure the role:
      • Custom Role Name: Enter the ID of the hosted connector that you just created.
      • Description: Enter a description for the custom role.
      • Select Clone a Role > Reader.
   4. Click Review and Create, then click Create.
2. Click +Add then click Add role assignment.
   1. Search for the ID of the custom role you just created, then select the role.
   2. Click Next.
   3. Click +Select members.
   4. Search for the Censys Cloud Connector Enterprise Application then click Select.
   5. Click Review and assign, then click Review and assign again.

3. Initiate a permissions check to verify that all permissions are properly granted.

   1. Navigate back to the API Documentation.
   2. Expand the POST /v1/hosted-connectors/{id}/check endpoint.
   3. Click Try it out.
   4. Paste in the ID of the connector to want to check.
      • You can find the ID in the response from creating the hosted connector. For example: censys-cc-[unique_string].
   5. Click Execute. In the response body, use the Date field to note the time that the check was started.
4. Using the GET /v1/hosted-connectors/{id} endpoint, check the status.
   1. Expand GET /v1/hosted-connectors/{id} and click Try it out.
   2. Paste the ID of the connector you wish to check, then click Execute.
      • Verify that statusTimestamp is the same time as what you noted from the /check endpoint.
      • Verify that status is either “checking-configuration” or “connected”.
        • If status is “connected”, your connector is correctly configured.
        • If status is “checking-configuration”, wait a few moments and Execute the GET call again.
        • If status is “not-connected”, check the response for errors that need to be corrected

JSON Examples