Sam360’s Azure integration imports Azure tenant, subscription, resource, virtual machine, SQL Server, host, Azure Hybrid Benefit, and optional resource cost and VM scan data on a scheduled basis.

The integration is configured from the Sam360 Management Point using the Azure setup wizard. The wizard creates a dedicated Sam360 application registration and client secret, requests admin consent for the required Microsoft Graph application permissions, and stores the application credentials locally on the Management Point.

Data Imported by Sam360

  • Azure tenant and subscription details.
  • Azure resource inventory, including resource groups, resource names, resource types, SKU information, locations, tags, and selected resource properties.
  • Azure virtual machine inventory, including VM size, operating system, image, power state, network, disk, SQL VM, location, and tag details.
  • Dedicated host, SQL Server, and SQL database details.
  • Actual and amortized Azure resource costs when cost reporting is enabled.
  • Detailed Windows VM inventory scan results when Azure VM scanning is enabled.

Administrator Account Required During Setup

Use the same Microsoft Entra administrator account for both Microsoft sign-ins. The account must have either:

  • the Global Administrator role; or
  • the Privileged Role Administrator role together with either the Application Administrator or Cloud Application Administrator role.

The required roles allow the setup wizard to create the Sam360 application registration and client secret and grant admin consent to the required Microsoft Graph application permissions. If the wizard will assign Azure subscription roles, this same administrator account must also have the required Azure RBAC role shown below.

Sam360 does not store the administrator’s password or interactive sign-in tokens. After setup, the integration runs unattended as the dedicated Sam360 application, using the application client ID and client secret stored on the Management Point.

Azure subscription roles: if the wizard will assign Reader, Billing Reader, or the VM Scan custom role, the administrator account must also have the Azure RBAC rights described below on every included subscription.

Microsoft Graph Application Permissions

To collect Azure tenant and directory context, Sam360 uses a dedicated application in the target Microsoft Entra tenant. The application is configured with the following Microsoft Graph application permissions.

PermissionReason
Organization.Read.AllRead tenant organisation details used to identify and correlate Azure tenant data.
Directory.Read.AllRead directory details used to correlate Azure tenant and application-principal information.

The integration runs unattended as the Sam360 application identity. It does not run as the setup administrator or as an interactive user.

Azure Subscription Role Options

The Azure setup wizard can assign Azure roles to the Sam360 app principal. These roles are assigned at subscription scope for the subscriptions included in the setup.

Wizard optionRole assignedReporting enabled
Add Reader Role to App PrincipalReaderEnables core Azure inventory reporting, including subscriptions, resources, resource groups, VMs, hosts, SQL servers, SQL databases, locations, SKUs, tags, and Azure Hybrid Benefit details.
Add Billing Reader Role to App PrincipalBilling ReaderEnables Azure cost reporting, including actual and amortized usage cost by resource and subscription. Without this role, inventory can still run but cost reporting may be blank or incomplete.
Add VM Scan Role to App PrincipalSam360 Azure VM Scan RunnerEnables detailed inventory scanning of Azure Windows VMs through the Azure API. This custom role can read subscriptions, resource groups, virtual machines, and Run Command metadata, and can invoke VM Run Command to run the Sam360 inventory scan on supported running Windows VMs.
Why we recommend Billing Reader: this allows Sam360 to collect Azure billing and cost information, including resource cost data. The standard Reader role is enough for inventory-style data such as subscriptions, resources, VMs, SQL servers, and related metadata, but billing and cost queries can be denied unless the app principal also has billing or cost visibility. Without this role, the Azure inventory may still run, but billing and cost sections may be blank or incomplete.

Azure RBAC Required During Setup

The administrator account used for the setup must already have enough Azure RBAC authority to add each selected role to the Sam360 app principal. The following built-in Azure roles provide the required authority.

Wizard optionRole added to app principalAzure role required by the setup administrator
Add Reader RoleReaderRole Based Access Control Administrator, User Access Administrator, or Owner. The required permission is Microsoft.Authorization/roleAssignments/write.
Add Billing Reader RoleBilling ReaderRole Based Access Control Administrator, User Access Administrator, or Owner. The required permission is Microsoft.Authorization/roleAssignments/write.
Add VM Scan RoleSam360 Azure VM Scan RunnerUser Access Administrator or Owner. The administrator needs both Microsoft.Authorization/roleDefinitions/write to create or update the custom role and Microsoft.Authorization/roleAssignments/write to assign it. Role Based Access Control Administrator alone is not sufficient.

The required Azure role must apply to every included subscription, either directly or through inheritance from a management group. Microsoft Entra administrator roles, including Global Administrator, do not automatically provide these Azure RBAC permissions.

Tenant and Subscription Selection

The wizard also includes Choose Tenant and Subscriptions During Setup. Select this option when the setup administrator can access more than one Azure tenant or subscription, or when only specific subscriptions should be included in Sam360 reporting.

When this option is selected, the setup process asks the administrator to choose the tenant and confirm the enabled subscriptions that Sam360 should include. The wizard then applies the selected Azure role options only to those subscriptions. Exclude any subscription that Sam360 should not read or report on.

Before You Start

  1. Check that the required PowerShell modules for Azure integration are installed on the Management Point.

    1. Start the Management Point Configuration Tool.
    2. Open the Advanced tab.
    3. Open the Components tab.
    4. Review the module list and the ActionRequired column.
    5. If any required module needs installing or updating, select Update Modules.
    Management Point Configuration Tool Advanced Components tab showing the Update Modules button

  2. Ensure that the Management Point can make outbound HTTPS connections to the Microsoft endpoints required for authentication, Microsoft Graph, and Azure Resource Manager during setup and scheduled Azure synchronisation.

    EndpointPurpose
    login.microsoftonline.com:443Microsoft identity platform authentication.
    graph.microsoft.com:443Microsoft Graph API access for tenant and directory context.
    management.azure.com:443Azure Resource Manager access for subscription, resource inventory, cost, and VM scan operations.

  3. Have one Microsoft Entra administrator account available for both sign-ins. The account must be a Global Administrator, or it must have Privileged Role Administrator together with either Application Administrator or Cloud Application Administrator.

  4. If the wizard will assign Azure subscription roles, ensure that this account also has the required Azure role-assignment and, where applicable, custom-role-definition rights on every subscription that should be included.

  5. Decide whether Sam360 should collect resource costs and whether Sam360 should run detailed scans on Azure Windows VMs.

Configure the Integration in the Management Point

1. Open the task list

Start the Management Point Configuration Tool and open the Tasks tab.

Sam360 Management Point Configuration Tool showing the Tasks tab and Add Task button

2. Add the Azure cloud service task

Select Add Task > Cloud Service > Azure.

Add Task menu showing Cloud Service and Azure

3. Configure the Azure sync task

  1. Enter a clear task name and description.
  2. Leave Tenant ID as default for normal setup. Enter a specific tenant ID only if the setup administrator has access to multiple Azure tenants and the wizard does not offer the tenant that should be configured.
  3. Select the Azure role options that match the reporting required for the customer.
  4. Select Choose Tenant and Subscriptions During Setup if the administrator should confirm exactly which subscriptions are included.
  5. Select Set Up Azure Integration.
Azure Sync task setup window showing role options and Set Up Azure Integration button

4. Sign in twice and approve the application permissions

  1. At the first Microsoft sign-in prompt, sign in to the target Azure tenant with the administrator account described above.
  2. If tenant and subscription selection is enabled, choose the correct tenant and include only the subscriptions that Sam360 should report on.
  3. Wait while the wizard creates the Sam360 Azure Integration application registration and client secret.
  4. When Microsoft’s administrator-consent page opens in the default browser, sign in again with the same administrator account if prompted.
  5. Confirm that the consent page is for the correct tenant and the Sam360 Azure Integration application.
  6. Review the Microsoft Graph application permissions listed above, then select Accept.
  7. Return to the setup wizard and leave it running while it verifies the consent and application credentials and assigns any selected Azure roles.
If the consent page says that the application cannot be found: wait 30 seconds, refresh the browser page, and continue with the second sign-in and consent.

5. Save the task

  1. When setup completes, confirm that the task has the expected tenant and integration details.
  2. Select OK to save the task.
  3. Run the task or wait for the next scheduled sync.

After the First Sync

The Management Point will connect to Azure using the stored application credentials and import the Azure data used by Sam360 reports. Inventory reporting requires the Reader role on the included subscriptions. Cost reporting requires Billing Reader. Detailed Azure Windows VM inventory scans require the VM Scan role and only run on supported running Windows VMs.

Manual Setup Option

If your organisation requires the application registration to be created manually, contact Sam360 Support for the Azure App Principal Setup Guide. Manual setup is not required when using the Management Point setup wizard.

If manual setup is used, create the app registration, create a client secret, grant the Microsoft Graph application permissions listed above, grant admin consent, assign the required Azure subscription roles, and store the application client ID and client secret in the Sam360 Management Point.

Security Notes

  • Do not assign Owner or Contributor to the Sam360 app principal. Sam360 does not require those roles for standard Azure inventory or cost reporting.
  • Assign roles only at the subscription scopes that Sam360 should access.
  • Store and transmit the client secret securely. Do not send the client secret by email unless the customer has explicitly approved that method.
  • Rotate the client secret before expiry and update the Management Point with the new value.

Partner First

Enabling data driven IT projects

Get Support

    support@sam360.com
    Mon-Fri: 09:00 – 18:00 UTC
  • +353 1 566 6390‬

Find Us

NCI Research Centre, IFSC Dublin 1, Ireland
Go to Top