> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-outposts/microsoft-azure.md). # Microsoft Azure The following table lists the static resources deployed on outposts in Microsoft Azure.

Scope	IaC Resource Type	Technical Resource Name	Required for These Modules	Purpose
Global	`azuread_application_api_access`	`outpost_o365_rms_api`	DSPM	This resource grants API access permissions to the Microsoft Graph API for the outpost_o365_rms_api application. Cortex requires these permissions for DSPM to scan Office 365 environments and identify sensitive data or configuration risks.
Global	`azuread_application_api_access`	`outpost_o365_sharepoint_api`	DSPM	This resource grants API access permissions to the Microsoft Graph API for the outpost_o365_sharepoint_api application. Cortex requires these permissions for DSPM to scan Office 365 environments and identify sensitive data or configuration risks.
Global	`azuread_application_federated_identity_credential`	`federated_cts_gke_serviceaccount`	Registry, DSPM, ADS, Serverless	This resource manages the federated identity credential for the federated_cts_gke_serviceaccount application. It establishes a secure authentication bridge between Cortex and the customer-managed environment to allow the outpost to authenticate without persistent secrets.
Global	`azuread_application_federated_identity_credential`	`federated_cts_gke_serviceaccount_o365_app`	DSPM	This resource manages the federated identity credential for the federated_cts_gke_serviceaccount_o365_app application. It establishes a secure authentication bridge between Cortex and the customer-managed environment to allow the outpost to authenticate without persistent secrets.
Global	`azuread_application_federated_identity_credential`	`federated_dspm_managed_identity`	DSPM	This resource manages the federated identity credential for the federated_dspm_managed_identity application. It establishes a secure authentication bridge between Cortex and the customer-managed environment to allow the outpost to authenticate without persistent secrets.
Global	`azuread_application_federated_identity_credential`	`federated_dspm_managed_identity_o365_app`	DSPM	This resource manages the federated identity credential for the federated_dspm_managed_identity_o365_app application. It establishes a secure authentication bridge between Cortex and the customer-managed environment to allow the outpost to authenticate without persistent secrets.
Global	`azuread_application_federated_identity_credential`	`federated_registry_managed_identity`	Registry	This resource manages the federated identity credential for the federated_registry_managed_identity application. It establishes a secure authentication bridge between Cortex and the customer-managed environment to allow the outpost to authenticate without persistent secrets.
Global	`azuread_application_federated_identity_credential`	`federated_serverless_managed_identity`	Serverless	This resource manages the federated identity credential for the federated_serverless_managed_identity application. It establishes a secure authentication bridge between Cortex and the customer-managed environment to allow the outpost to authenticate without persistent secrets.
Global	`azuread_application_redirect_uris`	`outpost_registration_redirect_uri`	DSPM	This resource configures the redirect URIs for the outpost_registration_redirect_uri application registration. Cortex requires these URIs to properly handle authentication responses and redirect traffic to the Cortex platform during the DSPM setup.
Global	`azuread_application_redirect_uris`	`outpost_registration_redirect_uri_o365_app`	DSPM	This resource configures the redirect URIs for the outpost_registration_redirect_uri_o365_app application registration. Cortex requires these URIs to properly handle authentication responses and redirect traffic to the Cortex platform during the DSPM setup.
Global	`azuread_application_registration`	`outpost_app_registration`	ADS, Serverless, Registry, DSPM	This resource registers the outpost_app_registration application within Azure Active Directory to provide a unique identity for the outpost. Cortex uses this registration to establish the identity required for performing cross-tenant operations in ADS, Serverless, Registry, and DSPM.
Global	`azuread_application_registration`	`outpost_o365_app_registration`	DSPM	This resource registers the outpost_o365_app_registration application within Azure Active Directory to provide a unique identity for the outpost. Cortex uses this registration to establish the identity required for performing cross-tenant operations in DSPM.
Global	`azuread_service_principal`	`outpost_o365_sp`	DSPM	This resource creates a service principal for the outpost_o365_sp application to enable identity-based access to resources. Cortex utilizes this service principal to assign the specific permissions needed for scanners to access target resources during DSPM operations.
Global	`azuread_service_principal`	`outpost_sp`	ADS, Serverless, Registry, DSPM	This resource creates a service principal for the outpost_sp application to enable identity-based access to resources. Cortex utilizes this service principal to assign the specific permissions needed for scanners to access target resources during ADS, Serverless, Registry, and DSPM operations.
Regional	`azurerm_application_security_group`	`ads`	ADS	Note: This per-type ASG is not created by the current outpost terraform module. It may appear in deployments from older module versions; the current model uses the unified scanner ASG instead. This resource creates an Application Security Group (ASG) to group scanner virtual machines (VMs) by function. This ASG applies to all scanner VM types, including ADS, DSPM, Registry, and Serverless. By grouping these VMs, Cortex can simplify the management of security rules, applying traffic filtering policies to the functional group rather than to individual IP addresses.
Regional	`azurerm_application_security_group`	`dspm`	DSPM	Note: This per-type ASG is not created by the current outpost terraform module. It may appear in deployments from older module versions; the current model uses the unified scanner ASG instead. This resource creates an Application Security Group (ASG) used to group virtual machines based on their function for dspm. Cortex uses the ASG to simplify the management of security rules for scanners by applying policies to the functional group rather than individual IP addresses.
Regional	`azurerm_application_security_group`	`private_endpoint`	Serverless, Registry, DSPM	This resource creates an Application Security Group (ASG) to group private endpoints by function. By grouping these resources, Cortex can simplify the management of security rules, applying traffic filtering policies to the functional group rather than to individual IP addresses or subnets.
Regional	`azurerm_application_security_group`	`proxy`	Serverless, Registry, DSPM	This resource creates an Application Security Group (ASG) to group proxy virtual machines (VMs) by function. By grouping these VMs, Cortex can simplify the management of security rules, applying traffic filtering policies to the functional group rather than to individual IP addresses.
Regional	`azurerm_application_security_group`	`registry`	Registry	Note: This per-type ASG is not created by the current outpost terraform module. It may appear in deployments from older module versions; the current model uses the unified scanner ASG instead. This resource creates an Application Security Group (ASG) used to group virtual machines based on their function for registry. Cortex uses the ASG to simplify the management of security rules for scanners by applying policies to the functional group rather than individual IP addresses.
Regional	`azurerm_application_security_group`	`scanner`	ADS, Serverless, Registry, DSPM	This resource creates an Application Security Group (ASG) to group scanner virtual machines (VMs) by function. This ASG applies to all scanner VM types, including ADS, DSPM, Registry, and Serverless. By grouping these VMs, Cortex can simplify the management of security rules, applying traffic filtering policies to the functional group rather than to individual IP addresses.
Regional	`azurerm_application_security_group`	`serverless`	Serverless	Note: This per-type ASG is not created by the current outpost terraform module. It may appear in deployments from older module versions; the current model uses the unified scanner ASG instead. This resource creates an Application Security Group (ASG) used to group virtual machines based on their function for serverless. Cortex uses the ASG to simplify the management of security rules for scanners by applying policies to the functional group rather than individual IP addresses.
Regional	`azurerm_eventgrid_system_topic`	`eventgrid_topic`	ADS, Serverless, Registry, DSPM	This resource creates an Event Grid system topic to aggregate events from eventgrid_topic. Cortex monitors this topic to receive real-time notifications about resource changes that should trigger automated scanning or discovery tasks. Resource changes occur when new scan results are uploaded to the storage container, with the use of EventGrid and storage queue.
Regional	`azurerm_eventgrid_system_topic_event_subscription`	`bucket_communication`	ADS, Serverless, Registry, DSPM	This resource creates a subscription to the Event Grid system topic for the bucket_communication configuration. Cortex uses this subscription to deliver event data to the appropriate outpost component for immediate processing of new scan targets. The subscription routes storage-account change events to a storage queue endpoint that feeds the Cortex scan pipeline.
Regional	`azurerm_key_vault`	`outpost_key_vault`	Registry, DSPM	This resource creates the outpost_key_vault Azure Key Vault used to store secrets that scanner VMs and the Cortex platform retrieve at runtime. Its primary content is registry access keys (for Registry scanner authentication to customer container registries) and data-store access credentials (for DSPM scanners). The Key Vault is a Standard-SKU vault with soft-delete (7-day retention) and purge protection enabled; access is restricted by the network ACL to the outpost subnet plus the explicitly allowlisted Cortex platform public IPs.
Regional	`azurerm_key_vault_access_policy`	`dspm_vm_kv_policy`	Registry, DSPM	This resource defines the access policy for the dspm_vm_kv_policy identity to interact with the Azure Key Vault. Cortex configures these policies to grant scanners the permissions needed to retrieve secrets during scanning and discovery.
Regional	`azurerm_key_vault_access_policy`	`registry_vm_kv_policy`	Registry, DSPM	This resource defines the access policy for the registry_vm_kv_policy identity to interact with the Azure Key Vault. Cortex configures these policies to grant scanners the permissions needed to retrieve secrets during scanning and discovery.
Regional	`azurerm_key_vault_access_policy`	`st_kv_policy`	Registry, DSPM	This resource defines the access policy for the st_kv_policy identity to interact with the Azure Key Vault. Cortex configures these policies to grant scanners the permissions needed to retrieve secrets during scanning and discovery.
Regional	`azurerm_network_security_group`	`outpost`	ADS, Serverless, Registry, DSPM	This resource creates the regional outpost Network Security Group (NSG), which is used to filter and control inbound and outbound traffic for the outpost. Cortex uses this NSG to enforce security boundaries, ensuring that scanners for ADS, Serverless, Registry, and DSPM operations can only communicate with authorized endpoints. The NSG segments the scanner, proxy, and private endpoint subnets.
Regional	`azurerm_network_security_rule`	`allow_active_directory_outbound_dspm`	DSPM	This resource defines the allow_active_directory_outbound_dspm security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage dspm scanning of Active Directory during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_active_directory_outbound_scanner`	DSPM	This resource defines the azurerm_network_security_rule allow_active_directory_outbound_scanner security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow scanners to outbound to the Active Directory service tag during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_azure_cloud_outbound_dspm`	DSPM	This resource defines the allow_azure_cloud_outbound_dspm security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage dspm scanning cloud outbound for AzureCloud during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_azure_cloud_outbound_proxy`	Serverless, Registry, DSPM	This resource defines the allow_azure_cloud_outbound_proxy security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage cloud outbound for egress during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_azure_cloud_outbound_registry`	Registry	This resource defines the allow_azure_cloud_outbound_registry security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage registry scanning cloud outbound for AzureCloud during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_azure_cloud_outbound_scanner`	ADS, Serverless, Registry, DSPM	This resource defines the azurerm_network_security_rule allow_azure_cloud_outbound_scanner security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow scanners to outbound to the AzureCloud service tag during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_azure_cloud_outbound_serverless`	Serverless	This resource defines the allow_azure_cloud_outbound_serverless security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage serverless scanning cloud outbound for AzureCloud during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_cognitive_services_frontend_outbound_dspm`	DSPM	This resource defines the allow_cognitive_services_frontend_outbound_dspm security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage AISPM scanning for the Azure Cognitive Services service tag during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_cognitive_services_frontend_outbound_scanner`	DSPM	This resource defines the azurerm_network_security_rule allow_cognitive_services_frontend_outbound_scanner security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage AISPM scanning for the Azure Cognitive Services service tag during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_cognitive_services_management_outbound_dspm`	DSPM	This resource defines the allow_cognitive_services_management_outbound_dspm security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage AISPM scanning for the Azure Cognitive Services service tag during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_cognitive_services_management_outbound_scanner`	DSPM	This resource defines the azurerm_network_security_rule allow_cognitive_services_management_outbound_scanner security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage AISPM scanning for the Azure Cognitive Services service tag during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_cosmosdb_outbound_scanner`	DSPM	This resource defines the azurerm_network_security_rule allow_cosmosdb_outbound_scanner security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow scanners to outbound to Cosmos DB during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_frontdoor_outbound_dspm`	DSPM	This resource defines the allow_frontdoor_outbound_dspm security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage AISPM scanning for Front Door during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_frontdoor_outbound_scanner`	DSPM	This resource defines the azurerm_network_security_rule allow_frontdoor_outbound_scanner security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow dspm scanners to Front Door during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_key_vault_outbound_dspm`	DSPM	This resource defines the allow_key_vault_outbound_dspm security rule within an NSG to permit or deny specific network traffic. Cortex uses this rule to enable scanners to reach the Key Vault for retrieving encryption keys or secrets.
Regional	`azurerm_network_security_rule`	`allow_key_vault_outbound_registry`	Registry	This resource defines the allow_key_vault_outbound_registry security rule within an NSG to permit or deny specific network traffic. Cortex uses this rule to enable scanners to reach the Key Vault for retrieving encryption keys or secrets.
Regional	`azurerm_network_security_rule`	`allow_key_vault_outbound_scanner`	Registry, DSPM	This resource defines the azurerm_network_security_rule allow_key_vault_outbound_scanner security rule within an NSG to permit or deny specific network traffic. Cortex uses this rule to enable scanners to reach the Key Vault for retrieving encryption keys or secrets.
Regional	`azurerm_network_security_rule`	`allow_outbound_to_proxy_dspm_vms`	DSPM	This resource defines the allow_outbound_to_proxy_dspm_vms security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage dspm scanning access to the egress VM during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_outbound_to_proxy_registry_vms`	Registry	This resource defines the allow_outbound_to_proxy_registry_vms security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage registry scanning access to the egress VM during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_outbound_to_proxy_scanner_vms`	Serverless, Registry, DSPM	This resource defines the azurerm_network_security_rule allow_outbound_to_proxy_scanner_vms security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow scanners to outbound to the egress proxy during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_outbound_to_proxy_serverless_vms`	Serverless	This resource defines the allow_outbound_to_proxy_serverless_vms security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage serverless scanning access to the egress VM during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_private_endpoint_dspm`	DSPM	This resource defines the allow_private_endpoint_dspm security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to manage dspm scanning access to private endpoints during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_private_endpoint_inbound_dspm`	DSPM	This resource defines the allow_private_endpoint_inbound_dspm security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow dspm scanning access to private endpoints during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_private_endpoint_inbound_registry`	Registry	This resource defines the allow_private_endpoint_inbound_registry security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow registry scanning access to private endpoints during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_private_endpoint_inbound_scanner`		This resource defines the allow_private_endpoint_inbound_scanner security rule within an NSG to permit or deny specific network traffic to the private endpoints, allowing scanning of Azure PaaS services. Cortex implements this rule to allow scanning access to private endpoints.
Regional	`azurerm_network_security_rule`	`allow_private_endpoint_registry`	Registry	This resource defines the allow_private_endpoint_registry security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow registry scanning access to private endpoints during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_private_endpoint_scanner`	DSPM	This resource defines the azurerm_network_security_rule allow_private_endpoint_scanner security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow scanners to outbound to private endpoints during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_proxy_inbound_from_dspm_vm`	DSPM	This resource defines the allow_proxy_inbound_from_dspm_vm security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow dspm scanning access to the egress VM during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_proxy_inbound_from_registry_vms`	Registry	This resource defines the allow_proxy_inbound_from_registry_vms security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow registry scanning access to the egress VM during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_proxy_inbound_from_scanner_vm`		This resource defines the allow_proxy_inbound_from_scanner_vm security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow scanner VM access to the ingress VM during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_proxy_inbound_from_serverless_vms`	Serverless	This resource defines the allow_proxy_inbound_from_serverless_vms security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow serverless scanning access to the egress VM during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_proxy_vm_outbound`	Serverless, Registry, DSPM	This resource defines the allow_proxy_vm_outbound security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow egress VM outbound communication during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_resource_manager_outbound_dspm`	DSPM	This resource defines the allow_resource_manager_outbound_dspm security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow communication with the Azure Resource Manager service tag during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_resource_manager_outbound_scanner`	DSPM, Registry, Serverless, ADS	This resource defines the azurerm_network_security_rule allow_resource_manager_outbound_scanner security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow scanners to communicate with the Azure Resource Manager service tag during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_sql_outbound_dspm`	DSPM	This resource defines the allow_sql_outbound_dspm security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow dspm scanner outbound to SQL during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_sql_outbound_scanner`	DSPM	This resource defines the azurerm_network_security_rule allow_sql_outbound_scanner security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to allow scanners to outbound to Azure SQL during the outpost scanning and discovery process.
Regional	`azurerm_network_security_rule`	`allow_storage_outbound_ads`	ADS	This resource defines the allow_storage_outbound_ads security rule within an NSG to permit or deny specific network traffic. Cortex configures this rule to allow outbound communication from scanners to Azure Storage for data retrieval and result logging.
Regional	`azurerm_network_security_rule`	`allow_storage_outbound_dspm`	DSPM	This resource defines the allow_storage_outbound_dspm security rule within an NSG to permit or deny specific network traffic. Cortex configures this rule to allow outbound communication from scanners to Azure Storage for data retrieval and result logging.
Regional	`azurerm_network_security_rule`	`allow_storage_outbound_proxy`	Serverless, Registry, DSPM	This resource defines the allow_storage_outbound_proxy security rule within an NSG to permit or deny specific network traffic. Cortex configures this rule to allow outbound communication from scanners to Azure Storage for data retrieval and result logging.
Regional	`azurerm_network_security_rule`	`allow_storage_outbound_registry`	Registry	This resource defines the allow_storage_outbound_registry security rule within an NSG to permit or deny specific network traffic. Cortex configures this rule to allow outbound communication from scanners to Azure Storage for data retrieval and result logging.
Regional	`azurerm_network_security_rule`	`allow_storage_outbound_scanner`	ADS, Serverless, Registry, DSPM	This resource defines the azurerm_network_security_rule allow_storage_outbound_scanner security rule within an NSG to permit or deny specific network traffic. Cortex configures this rule to allow outbound communication from scanners to Azure Storage for data retrieval and result logging.
Regional	`azurerm_network_security_rule`	`deny_all_inbound_rule`	ADS, Serverless, Registry, DSPM	This resource defines the deny_all_inbound_rule security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule as a security best practice to block all unauthorized traffic that does not match more specific allow rules.
Regional	`azurerm_network_security_rule`	`deny_all_outbound_rule`	ADS, Serverless, Registry, DSPM	This resource defines the deny_all_outbound_rule security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule as a security best practice to block all unauthorized traffic that does not match more specific allow rules.
Regional	`azurerm_network_security_rule`	`deny_proxy_vm_outbound_to_subnet`	Serverless, Registry, DSPM	This resource defines the deny_proxy_vm_outbound_to_subnet security rule within an NSG to permit or deny specific network traffic. Cortex implements this rule to deny proxy access to the subnet during the outpost scanning and discovery process.
Global	`azurerm_resource_group`	`azure_outpost_cwp_agentless`	ADS, Serverless, Registry, DSPM	This resource defines the azure_outpost_cwp_agentless Azure Resource Group which serves as a logical container for related outpost infrastructure. Cortex uses this group to organize and manage the lifecycle of all infrastructure components deployed in the customer environment.
Global	`azurerm_role_assignment`	`cortex_private_endpoint_role_assignment`	Serverless, Registry, DSPM	This resource assigns an Azure RBAC role to a specific identity for the cortex_private_endpoint_role_assignment scope. Cortex uses these assignments to grant outpost managed identities the precise permissions needed to scan resources or manage data in storage accounts for Serverless, Registry, and DSPM.
Global	`azurerm_role_assignment`	`cortex_role_assignment`	ADS, Serverless, Registry, DSPM	This resource assigns an Azure RBAC role to a specific identity for the cortex_role_assignment scope. Cortex uses these assignments to grant outpost managed identities the precise permissions needed to scan resources or manage data in storage accounts for ADS, Serverless, Registry, and DSPM.
Global	`azurerm_role_assignment`	`cortex_storage_queue_role_assignment`	ADS, Serverless, Registry, DSPM	This resource assigns an Azure RBAC role to a specific identity for the cortex_storage_queue_role_assignment scope. Cortex uses these assignments to grant outpost managed identities the precise permissions needed to scan resources or manage data in storage accounts for ADS, Serverless, Registry, and DSPM.
Global	`azurerm_role_assignment`	`dspm_managed_identity_storage_blob_role_assignment`	DSPM	This resource assigns an Azure RBAC role to a specific identity for the dspm_managed_identity_storage_blob_role_assignment scope. Cortex uses these assignments to grant outpost managed identities the precise permissions needed to scan resources or manage data in storage accounts for DSPM.
Global	`azurerm_role_assignment`	`managed_identity_storage_blob_role_assignment`	ADS	This resource assigns an Azure RBAC role to a specific identity for the managed_identity_storage_blob_role_assignment scope. Cortex uses these assignments to grant outpost managed identities the precise permissions needed to scan resources or manage data in storage accounts for ADS.
Global	`azurerm_role_assignment`	`proxy_managed_identity_storage_blob_proxy_role_assignment`	Serverless, Registry, DSPM	This resource assigns an Azure RBAC role to a specific identity for the proxy_managed_identity_storage_blob_proxy_role_assignment scope. Cortex uses these assignments to grant outpost managed identities the precise permissions needed to scan resources or manage data in storage accounts for Serverless, Registry, and DSPM.
Global	`azurerm_role_assignment`	`registry_managed_identity_storage_blob_role_assignment`	Registry	This resource assigns an Azure RBAC role to a specific identity for the registry_managed_identity_storage_blob_role_assignment scope. Cortex uses these assignments to grant outpost managed identities the precise permissions needed to scan resources or manage data in storage accounts for Registry.
Global	`azurerm_role_assignment`	`serverless_managed_identity_storage_blob_role_assignment`	Serverless	This resource assigns an Azure RBAC role to a specific identity for the serverless_managed_identity_storage_blob_role_assignment scope. Cortex uses these assignments to grant outpost managed identities the precise permissions needed to scan resources or manage data in storage accounts for Serverless.
Global	`azurerm_role_assignment`	`storage_blob_role_assignment`	ADS, Serverless, Registry, DSPM	This resource assigns an Azure RBAC role to a specific identity for the storage_blob_role_assignment scope. Cortex uses these assignments to grant outpost managed identities the precise permissions needed to scan resources or manage data in storage accounts for ADS, Serverless, Registry, and DSPM.
Global	`azurerm_role_definition`	`app_registration_cortex_role`	ADS, Serverless, Registry, DSPM	This resource defines the App Registration Cortex Role (also referred to as Workload Orchestrator), a custom Azure RBAC role with actions scoped to the resource group.
Regional	`azurerm_storage_account`	`storage_account`	ADS, Serverless, Registry, DSPM	This resource creates the storage_account Azure Storage account to provide durable and highly available cloud storage. The outpost uses this account to store temporary scan results and facilitate communication between the local environment and the Cortex platform.
Regional	`azurerm_storage_container`	`artifact_container`	DSPM	This resource creates the artifact_container blob container within the storage account. Cortex utilizes this container to manage data objects and facilitate bucket-level communication for the DSPM modules.
Regional	`azurerm_storage_container`	`bucket_communication`	ADS, Serverless, Registry, DSPM	This resource creates the bucket_communication blob container within the storage account. Cortex utilizes this container to manage data objects and facilitate bucket-level communication for the ADS, Serverless, Registry, and DSPM modules.
Regional	`azurerm_storage_management_policy`	`storage_management_policy`	ADS, Serverless, Registry, DSPM	This resource configures lifecycle management rules for the storage account. Cortex applies this policy to automatically delete old scan data and logs to minimize storage costs and meet data retention requirements. The policy can also tier blobs to cooler storage classes on a schedule.
Regional	`azurerm_storage_queue`	`bucket_communication`	ADS, Serverless, Registry, DSPM	This resource creates the bucket_communication storage queue to support asynchronous message processing. Cortex uses this queue to notify the system of new events when a new blob is uploaded to a storage container during ADS, Serverless, Registry, and DSPM scans.
Regional	`azurerm_subnet`	`outpost_subnet`	ADS, Serverless, Registry, DSPM	This resource defines the outpost_subnet, a dedicated and private subnet within the Virtual Network. Cortex hosts outpost scanners for ADS, Serverless, Registry, and DSPM within this subnet, which logically separates scanning traffic from other workloads in the customer's environment. By default, this subnet is configured to be private, enables regional service endpoints, and includes Network Security Group (NSG) support for private endpoints.
Regional	`azurerm_subnet_network_security_group_association`	`outpost_subnet_nsg_association`	ADS, Serverless, Registry, DSPM	This resource links a network security group to the outpost_subnet subnet. Cortex requires this association to apply the defined security rules to the outpost scanners hosted within that subnet.
Global	`azurerm_user_assigned_identity`	`agentless`	ADS	This resource creates a user-assigned managed identity for the agentless (ADS) component. To enable secure cross-tenant authentication, this identity must be registered as a federated credential on the outpost App Registration. The outpost scanners use this identity to securely interact with Azure APIs and storage resources without the need for manual credential management.
Global	`azurerm_user_assigned_identity`	`dspm`	DSPM	This resource creates a user-assigned managed identity for the DSPM component. To enable secure cross-tenant authentication, this identity must be registered as a federated credential on the outpost App Registration. The outpost scanners use this identity to securely interact with Azure APIs and storage resources without the need for manual credential management.
Global	`azurerm_user_assigned_identity`	`proxy`	Serverless, Registry, DSPM	This resource creates a user-assigned managed identity for the proxy component. The outpost scanners use this identity to securely interact with Azure APIs and storage resources without the need for manual credential management.
Global	`azurerm_user_assigned_identity`	`registry`	Registry	This resource creates a user-assigned managed identity for the registry component. To enable secure cross-tenant authentication, this identity must be registered as a federated credential on the outpost App Registration. The outpost scanners use this identity to securely interact with Azure APIs and storage resources without the need for manual credential management.
Global	`azurerm_user_assigned_identity`	`serverless`	Serverless	This resource creates a user-assigned managed identity for the serverless component. To enable secure cross-tenant authentication, this identity must be registered as a federated credential on the outpost App Registration. The outpost scanners use this identity to securely interact with Azure APIs and storage resources without the need for manual credential management.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-outposts/microsoft-azure.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.