Configure Azure and Commvault to discover resources using Express configuration

Complete the following configurations before connecting your Azure account using Commvault to discover and protect Azure resources.

To discover resources with Commvault, you can configure access to Azure resources using the Commvault Express configuration. Create a multi-tenant Azure AD application using the federated identity credentials or client secret authentication method.

Register an Azure application

To create a multi-tenant Azure AD application, do the following:

1. Log on to the Azure portal https://portal.azure.com using your global administrator account.

2. Go to Azure Active Directory.

3. From the navigation pane, click App registrations.

4. Click New registration.

5. For Name, enter CommvaultCloudDiscovery.

6. Under Supported account types, select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).

7. For Redirect URI, enter the Command Center URL.

   For example, enter Redirect URI: https://$[CommandCenterHost]/commandcenter/processAzureAuthToken.do

8. Click Register.

Request and grant permissions for Azure APIs

1. From the Azure navigation pane, click API permissions.

2. Click Add a permission.

3. Do the following:

   1. In the Microsoft APIs tab, click Microsoft Graph, and then click Delegated permissions.

   2. Search and select User.Read.

   3. Click Add permissions.

      For more information regarding permissions, see Microsoft Permissions.

4. Click Add a permission.

5. Do the following:

   1. In the Microsoft APIs tab, click Azure Service Management, and then click Delegated permissions.

   2. Select user_impersonation to provide delegated permissions to access Azure Service Management as organization users.

   3. Click Add permissions.

Azure Express configuration using federated identity credentials

Express configuration uses federated identity credentials (managed identity), which is the most secure authentication method because it does not require an Azure secret key or certificate.

Configure a managed identity

Create a user-assigned managed identity in Azure and assign it to the CommServe VM. For more information, see Configuring Access to Azure Resources Using a Managed Identity.

Configure federated identity credentials on Azure application

Federated credentials allow the Azure application to authenticate using the managed identity. Do the following:

1. Log in to the Microsoft Entra admin center.

2. From the navigation pane, go to App registrations, and select your application.

3. From the left pane, select Certificates & secrets.

4. On the Federated credentials tab, click Add credential.

5. From the Federated credential scenario list, select Managed Identity.

6. The Issuer and Subject identifier fields are auto-populated.

7. For Name, enter the credential name.

8. For Audience, enter api://AzureADTokenExchange, and click Add.

For more information, see Configure a federated identity credential on an application article on Microsoft website.

Enable system-assigned managed identity

For Azure resource used as managed identity object, the system-assigned managed identity must be enabled. To enable system-assigned managed identity for the CommServe VM, do the following:

1. In the Azure portal, open the CommServe VM.

2. From the left navigation pane, go to Identity.

3. Under System assigned, set Status to On.

   For instructions, see Configure managed identities on Azure virtual machines (VMs) article on Microsoft website.

4. Click Save.

Create credentials in Commvault Credential Vault

Managed identity credentials

To create managed identity credentials in the Credential Vault, see Adding a Credential to a Built-in Credential Vault.

Use the following custom values:

Federated identity credentials

To create FIC in the Credential Vault, see Adding a Credential to a Built-in Credential Vault.

Use the following custom values:

Azure Express configuration using client secret authentication

If your CommServe VM is hosted in self-managed cloud or on-prem environments, complete the configurations described in this section.

Create a client secret for the Azure App

1. From the Azure navigation pane, click Certificates & secrets.

2. Click New client secret.

3. Enter the key description and expiration date.

4. Click Add.

5. Record the key value.

   Important

   The key value will be your application password. After you leave the Certificate & secrets section, you cannot retrieve the key value.

Create credentials in Commvault Credential Vault

To create credentials in the Credential Vault, see Adding a Credential to a Built-in Credential Vault.

Use the following custom values: