Setting Up an Application and Tenant for Azure Resource Manager

To create an Azure hypervisor in the Commvault software, you need to set up an application and tenant for the Azure Resource Manager.

An application is a specific cloud service that is associated with your Azure account, and the tenant is a client or organization that manages an instance of the cloud service. The application and tenant are associated with your subscription through Azure Active Directory, which provides identity and access management for the Azure cloud.

Before You Begin

You need the following information for the Azure application:

• Application name

• Application ID

• Subscription ID

• Tenant ID (Directory ID)

• Application key

You need the following information for the Azure account:

• The subscription ID

• User credentials with service administrator capabilities

Procedure

1. Log on to the public Azure portal with service administrator credentials.

2. From the All services menu, select the App registrations tab, and then click on New registration.

3. Specify the following:

   • Name: The name of the application to be created on Azure Active Directory.

   • Account type: Select one from the following:

     • Accounts in this organizational directory only

     • Accounts in any organizational directory

     • Accounts in any organizational directory and personal Microsoft accounts.

   • Redirect URI: (Optional) https://app_name (the URL, including the application name that you specify).

     For example, enter MyWebApp and https://MyWebApp.

4. Click Register.

   The application will be listed on the App Registration tab. Record the Application ID.

5. Go to the Certificates & secrets blade.

6. Click on New client secret, and then enter the key description and expiration date.

7. Click Save.

   A unique secret key is generated for the application.

   Important

   Save the client secret value. The client secret value will be your application secret. You will not be able to retrieve the key after you leave the Certificate & secrets tab/blade.

8. From the All services menu, click the Subscriptions tab, and then select the subscription ID that the hypervisor needs to be created for.

9. To define a custom role in order to specify more limited permissions that can be used for backup and restore operations instead of using the predefined Contributor role, do the following:

   Define a custom role, either for a specific resource group or for the entire subscription:

   1. Download the JSON for the type of backup that you want:

      • Unencrypted VM file backup: Download the CVBackupRole.json file, which contains the minimum permissions needed for data protection operations on Azure VMs.
        To back up Mysql and PostgreSQL databases on Azure, download the CvMySQLPostGreSQLCustomRole.json file.

      • Encrypted VM file backup: Download CVBackupRole-Encryption.json.

   2. In the JSON file, modify the following entry and change #SubscriptionID# to your subscription ID:

      "AssignableScopes" : ["/subscriptions/#SubscriptionID#"]

      To create a custom role, see Custom roles for Azure resources.

10. On the Access Control (IAM) tab, click Add, and then select Add role assignment.

    The Add role assignment pane appears.

11. Specify the following:

    1. From the Role list, select the Contributor role or the custom role that you created.

    2. From the Assign access to list, select User, group, or service principal.

    3. For Members, do the following:

       1. Click Select members.

          The Select members blade appears.

       2. In the Select box, start typing to select the application that you created in the preceding step.

12. Click Save.

13. To obtain the tenant ID (which is also the directory ID) from the public Azure cloud, go to Azure Active Directory > Properties > Directory.

14. If you are configuring a Linux proxy, you must add another role assignment, and select Storage Blob Data Contributor as the role.

What to Do Next

In the Commvault software, create the Azure hypervisor using the Subscription ID, Tenant ID, Application ID, and Application Key.

Related Topics

For a list of the permissions that are included in CVBackupRole.json, see Azure Resource Provider Usage.