> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-cloud-assets/ingest-cloud-assets-from-microsoft-azure.md).

# Ingest Cloud Assets from Microsoft Azure

{% hint style="info" %}

### Notice

Ingestion of Cloud Assets from Microsoft Azure requires a Cortex XDR Pro per GB license.
{% endhint %}

Cortex XDR provides a unified, normalized asset inventory for cloud assets in Microsoft Azure. This capability provides deeper visibility to all the assets and superior context for incident investigation.

To receive cloud assets from Microsoft Azure, you must configure the Collection Integrations settings in Cortex XDR using the Cloud Inventory data collector to configure the Microsoft Azure wizard. The Microsoft Azure wizard includes instructions to be completed both in Microsoft Azure and the Microsoft Azure wizard screens. After you set up data collection, Cortex XDR begins receiving new data from the source.

As soon as Cortex XDR begins receiving cloud assets, you can view the data in Assets → **Cloud Inventory**, where **All Assets** and **Specific Cloud Assets** pages display the data in a table format.

To configure the Microsoft Azure cloud assets collection in Cortex XDR.

1. Open the Microsoft Azure wizard in Cortex XDR.
   1. Select **Settings** → **Configurations** → **Data Collection** → **Collection Integrations**.
   2. In the **Cloud Inventory** configuration, click **Add Instance**.
   3. Click **Azure**.
2. Define the **Configure Account** screen of the wizard.

   Setting the connection parameters on the right-side of the screen are dependent on certain configurations in Microsoft Azure as explained below.

   1. Select the **Organization Level** as either **Subscription** (default), **Tenant**, or **Management Group**. The **Organization Level** that you select changes the instructions and fields displayed on the screen.
   2. Login to your [Microsoft Azure Portal](https://portal.azure.com/).
   3. Search for **Subscriptions**, select **Subscriptions**, copy the applicable **Subscription ID** in Azure, and paste it in the **Subscription ID** field in the **Configure Account** screen wizard in Cortex XDR.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>This step is only relevant if you’ve configured the Organization Level as <strong>Subscription</strong> in the <strong>Configure Account</strong> screen in Cortex XDR. Otherwise, you can skip this step if the <strong>Organization Level</strong> is set to <strong>Tenant</strong> or <strong>Management Group</strong>.</p></div>
   4. Search for **Management groups**, select **Management groups**, copy the applicable **ID** in Azure, and paste it in the **Management Group ID** field in the **Configure Account** screen wizard in Cortex XDR.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>This step is only relevant if you’ve configured the Organization Level as <strong>Management Group</strong> in the <strong>Configure Account</strong> screen in Cortex XDR. Otherwise, you can skip this step if the <strong>Organization Level</strong> is set to <strong>Subscription</strong> or <strong>Tenant</strong>.</p></div>
   5. Search for **Tenant properties**, select **Tenant properties**, copy the Tenant ID in Azure, and paste it in the **Tenant ID** field in the **Configure Account** screen wizard in Cortex XDR.
   6. Specify a **Cortex XDR Collection Name** to be displayed underneath the **Cloud Inventory** configuration for this Azure collection.
   7. Click **Next**.
3. Define the **Account Details** screen of the wizard.
   1. Download the Terraform **script**. The name of the file downloaded is dependent on the Organization Level that you configured in the **Configure Account** screen of the wizard.
      * **Subscription**: `cortex-xdr-azure-subscription-ro.tf`
      * **Management Group**: `cortex-xdr-azure-group-ro.tf`
      * **Tenant**: `cortex-xdr-azure-org-ro.tf`

        <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><h3>Warning</h3><p>To run the Terraform script when configuring the Organization Level at the Tenant level, you must first ensure that you elevate user access to manage all Azure subscriptions and management groups for the User Access Administrator role. For more information, see the <a href="https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin">Microsoft Azure documentation</a>.</p></div>
   2. Login to the [Azure Cloud Shell portal](https://portal.azure.com/#cloudshell/), and select **Bash**.
   3. Click the upload/download icon (![azure-cloud-shell-upload-icon.png](/files/b9rKijHmvhTAp5af2sJx)) to **Upload** the Terraform script to Cloud Shell, browse to the file, and click **Open**.

      A notification with the **Upload destination** is displayed on the bottom-right corner of the screen.
   4. Use the following commands to upload the Terraform script, which you can copy from the **Account Details** screen in Cortex XDR using the copy icon (![gcp-copy.png](/files/HxRSBvJ2vooJdcsqrtgl)).

      1. `terraform init`: Initializes the Terraform script. You need to wait until the initialization is complete before running the next command as indicated in the image below.

         ![azure-terraform-init-successful.png](/files/GR64q7MEz7kGwxrsvhuI)
      2. `terraform apply`: When running this command you will be asked to enter the following values, which are dependent on the Organization Level that you configured.

         <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Before running this command, ensure that your Azure CLI client is logged in by running <code>az login</code>. From the returned message from the login command, copy the code provided, go to the website mentioned in the message, and use the code to authenticate.</p><p>For more information, see <a href="https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli">Sign in with Azure CLI</a>.</p></div>

         * `var.subscription_id`: Specify the Subscription ID that you configured in the **Configure Account** screen of the wizard from Microsoft Azure. This value only needs to be specified if the Subscription ID is set to **Subscription**.
         * `var.management.group_id`: Specify the Management Group ID that you configured in the **Configure Account** screen of the wizard from Microsoft Azure. This value only needs to be specified if the Microsoft Group is set to **Management Group**.
         * `var.tenant_id`: Specify the Tenant ID that you configured in the **Configure Account** screen of the wizard from Microsoft Azure.

      Before the action completes, you need to confirm whether you want to perform these actions, and after the process finishes running an **Apply complete** indication is displayed.

      ![azure-apply-complete.png](/files/lxICC3sf3HRgFtT6gOXz)
   5. Copy the **client\_id** value displayed in the Cloud Shell window and paste it in the **Application Client ID** field in the **Account Details** screen in Cortex XDR.
   6. Copy the **secret** value displayed in the Cloud Shell window and paste it in the **Secret** field in the **Account Details** screen in Cortex XDR.
   7. Download the JSON file from Cloud Shell using the upload/download icon (![azure-cloud-shell-upload-icon.png](/files/b9rKijHmvhTAp5af2sJx)), so you have output field values for future reference.
   8. Click **Next**.
4. Review the **Summary** screen of the wizard.

   If something needs to be corrected, you can go **Back** to correct it.
5. Click **Create**.

   Once cloud assets from Azure start to come in, a green check mark appears underneath the **Cloud Inventory** configuration with the **Last collection time** displayed. It can take a few minutes for the **Last Collection time** to be displayed.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Whenever the Cloud Inventory data collector integrations are modified by using the <strong>Edit</strong>, <strong>Disable</strong>, or <strong>Delete</strong> options, it can take up to 10 minutes for these changes to be reflected in Cortex XDR.</p></div>
6. After Cortex XDR begins receiving Azure cloud assets, you can view the data in **Assets** → **Cloud Inventory**, where **All Assets** and **Specific Cloud Assets** pages display the data in a table format. For more information, see Cloud Inventory Assets.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-cloud-assets/ingest-cloud-assets-from-microsoft-azure.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
