> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/prerequisites.md).

# Prerequisites

> **Note:** Custom roles containing `DataActions` cannot be assigned directly at the management group scope. However, Microsoft allows these roles to include a management group in their `AssignableScopes`, provided they are assigned at the subscription scope. This guide strictly follows this supported pattern.

1. Ensure `az cli` is installed and authenticated.
2. Ensure you have the necessary permissions:
   * In Cortex, you must have a Cortex role with Data Sources - View & Edit permissions (to add/configure cloud accounts in Cortex). This role is included in the following built-in roles: Instance Administrator, Security Admin, and IT Admin.
   * In Microsoft Azure, to create the service principal and assign the required `Application.Read.All` Microsoft Graph permission to Cortex, the onboarding user must have the Application Administrator built-in Entra ID role.
3. Create the Cortex service principal.
4. Decide on your resource naming convention. Throughout this manual onboarding process, you will need to choose your own names for the resource group, custom roles, Event Hub namespace, storage account, UAMI. Use the Configuration values reference to keep track of the names as you will need to refer to them throughout the process.
5. Gather and record the following required Azure deployment variables. You will need to substitute these values throughout the configuration steps.

| Variable                 | Description                                                                                                                                                                                                                                                                                                              |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `<TENANT_ID>`            | Your Microsoft Entra ID tenant ID.                                                                                                                                                                                                                                                                                       |
| `<MG_ID>`                | <p>For MG onboarding: the child management group's name (not its <code>displayName</code>). Run <code>az account management-group list -o table</code> to find it.<br>For tenant root management group onboarding: the tenant ID (same value as <code>\<TENANT\_ID></code>). The tenant ID is also the root MG name.</p> |
| `<HOST_SUBSCRIPTION_ID>` | A stable, long-lived subscription under the target management group to host the audit logs infrastructure (Event Hub, UAMI, and Storage Account). Required only if audit log collection is enabled.                                                                                                                      |

### P.1 Create the Cortex service principal

The Cortex service principal is Cortex's primary runtime identity in your tenant. It is the identity that all subsequent custom role assignments bind to and Cortex uses it to read your Azure resources and perform actions for the capabilities you enable. When you enter your Azure tenant ID in the onboarding wizard, Cortex checks whether this service principal already exists in your tenant. If it does, no action is needed. If it is not found, you must create it:

1. Open Azure Cloud Shell in the tenant you are onboarding, or open a local terminal with the Azure CLI installed, and log in to the target tenant before executing the command below.
2. Run the following command:

```bash
az ad sp create --id <AZURE_TENANT_ID>
```

Where `<AZURE_TENANT_ID>` is the tenant ID of your Azure tenant.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/prerequisites.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.