> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/prerequisites.md).

# Prerequisites

Before you begin onboarding Azure to Cortex, ensure that you have the necessary permissions, credentials, and configuration details.

1. Ensure az CLI is installed and authenticated.
2. Ensure you have the necessary permissions:
   * In Cortex, you must have a Cortex role with Data Sources - View & Edit permissions (to add/configure cloud accounts in Cortex). This role is included in the following built-in roles: Instance Administrator, Security Admin, and IT Admin.
   * In Microsoft Azure, to create the service principal and assign the required Application.Read.All Microsoft Graph permission to Cortex, the onboarding user must have the Application Administrator built-in Entra ID role.
3. Identify and set your target subscription.
4. Grant admin consent to Cortex.
5. Decide on your resource naming convention. Throughout this manual onboarding process, you will need to choose your own names for the resource group, custom roles, Event Hub namespace, storage account, UAMI. Use the Configuration values reference to keep track of the names as you will need to refer to them throughout the process.
6. If you are enabling audit log collection, the namespace and Event Hub must belong to the specific Azure subscription being onboarded. Cross-subscription or centralized logging is not currently supported.

### P.1 Identify and set your target subscription

Identify your target subscription and retain the ID numbers as they will be required throughout the onboarding process. Your target subscription is the subscription where Cortex-managed resources are created and where roles are assigned.

To set your target subscription, in Azure Cloud Shell or your local terminal, run:

```shell
az login
az account set --subscription "<SUBSCRIPTION_ID>"
```

Where:

* `<SUBSCRIPTION_ID>`: The ID of the Azure subscription you are onboarding.

### P.2 Create the Cortex service principal

The Cortex service principal is Cortex's primary runtime identity in your tenant. It is the identity that all subsequent custom role assignments bind to and Cortex uses it to read your Azure resources and perform actions for the capabilities you enable. When you enter your Azure tenant ID in the onboarding wizard, Cortex checks whether this service principal already exists in your tenant. If it does, no action is needed. If it is not found, you must create it:

1. Open Azure Cloud Shell in the tenant you are onboarding, or open a local terminal with the Azure CLI installed, and log in to the target tenant before executing the command below.
2. Run the following command:

```shell
az ad sp create --id <AZURE_TENANT_ID>
```

Where `<AZURE_TENANT_ID>` is the tenant ID of your Azure tenant.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/prerequisites.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.