> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope.md). # Azure Manual Onboarding: Subscription Scope ## Overview of the onboarding process The following table lists every step in the procedure for manually onboarding Microsoft Azure. Use it as a checklist to track your progress. Steps marked as **Required** must be completed for every onboarding. Optional steps depend on the Cortex security capabilities you choose to enable. | Step | Procedure | Required? | Required for capability | Platform | | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ----------------------- | -------- | | **Prerequisites** | | | | | | P.1 | [Identify and set your target subscription](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/prerequisites.md) | Required | — | Azure | | P.2 | [Cortex admin consent](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/prerequisites.md) | Required | — | Azure | | **Phase 1: Create Azure cloud instance in Cortex** | | | | | | 1.1 | [Start the Azure onboarding wizard](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-1-create-azure-cloud-instance-in-cortex.md) | Required | — | Cortex | | 1.2 | [Download the customized identifiers file](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-1-create-azure-cloud-instance-in-cortex.md) | Required | — | Cortex | | **Phase 2: Deploy platform identity and base role** | | | | | | 2.1 | [Create the shared resource group](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-2-platform-identity-and-base-role.md) | Required | — | Azure | | 2.2 | [Create the Cortex-Platform-Base custom role](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-2-platform-identity-and-base-role.md) | Required | Assets Discovery | Azure | | 2.3 | [Assign Cortex-Platform-Base to the Cortex service principal](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-2-platform-identity-and-base-role.md) | Required | Assets Discovery | Azure | | **Phase 3: Create security capability roles** | | | | | | 3.1 | [DSPM - Data Security Posture Management](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | DSPM | Azure | | 3.1.1 | [Create the Cortex-DSPM custom role](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | DSPM | Azure | | 3.1.2 | [Create the Cortex-DSPM-RG custom role](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | DSPM | Azure | | 3.1.3 | [Assign the DSPM roles to the Cortex service principal](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | DSPM | Azure | | 3.2 | [ADS - Agentless Disk Scanning](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | ADS | Azure | | 3.2.1 | [Create the Azure Computer Gallery](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | ADS | Azure | | 3.2.2 | [Create the Cortex-ADS custom role](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | ADS | Azure | | 3.2.3 | [Create the Cortex-ADS-RG custom role](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | ADS | Azure | | 3.2.4 | [Assign ADS custom roles to the Cortex service principal](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | ADS | Azure | | 3.3 | [Registry Scanning](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | Registry Scanning | Azure | | 3.3.1 | [Create the Cortex-Registry custom role](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | Registry Scanning | Azure | | 3.3.2 | [Assign the Cortex-Registry custom role to the Cortex service principal](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | Registry Scanning | Azure | | 3.4 | [Automation](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | Automation | Azure | | 3.4.1 | [Create the Cortex-Automation custom role](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | Automation | Azure | | 3.4.2 | [Assign the Cortex-Automation custom role to the Cortex service principal](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | Automation | Azure | | 3.5 | [Serverless Scanning](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | Serverless Scanning | Azure | | 3.6 | [Kubernetes Security](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | Kubernetes | Azure | | 3.6.1 | [Create the Cortex-KSPM custom role](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | Kubernetes | Azure | | 3.6.2 | [Assign the Cortex-KSPM custom role to the Cortex service principal](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) | Optional | Kubernetes | Azure | | **Phase 4: Connect audit logs** | | | | | | 4 | [Audit Logs](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) | Optional | Audit Logs | Azure | | 4.1 | [Create the user-assigned managed identity (UAMI)](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) | Optional | Audit Logs | Azure | | 4.2 | [Configure workload identity federation for the UAMI](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) | Optional | Audit Logs | Azure | | 4.3 | [Create the storage account](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) | Optional | Audit Logs | Azure | | 4.4 | [Grant the UAMI Storage Blob Data Contributor role on the storage account](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) | Optional | Audit Logs | Azure | | 4.5 | [Create and secure the Event Hubs namespace](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) | Optional | Audit Logs | Azure | | 4.6 | [Create the Event Hub](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) | Optional | Audit Logs | Azure | | 4.7 | [Create an authorization rule on the namespace](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) | Optional | Audit Logs | Azure | | 4.8 | [Create the consumer group](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) | Optional | Audit Logs | Azure | | 4.9 | [Grant the UAMI Azure Event Hubs Data Receiver role on the namespace](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) | Optional | Audit Logs | Azure | | 4.10 | [Route the subscription Activity Log to the Event Hub](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) | Optional | Audit Logs | Azure | | **Phase 5: Complete the onboarding wizard** | | | | | | 5.1 | [Enter the Azure details in Cortex](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-5-complete-the-azure-onboarding-wizard-in-cortex.md) | Required | — | Cortex | | 5.2 | [Azure value reference guide](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-5-complete-the-azure-onboarding-wizard-in-cortex.md) | Reference | - | Cortex | | 5.3 | [Complete onboarding](/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-5-complete-the-azure-onboarding-wizard-in-cortex.md) | Required | — | Cortex | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.