---
updatedAt: 2025-09-25T00:29:02.000Z
agentTools:
projectIndex: https://gtidocs.readme.io/llms.txt
---
# ASM Azure Integration
> 🚧 Special privileges required
>
> This feature is only available to ASM administrators.
> ℹ️
>
> See how credentials for integrations are stored [here](https://gtidocs.readme.io/docs/asm-credential-security-details)
> ℹ️
>
> This integration is not currently supported for Azure Government users.
With Azure, Attack Surface Management (ASM) retrieves public virtual machine (VM) instances, public DNS zones, and Blob Storage resources. For Blobs, ASM checks to see if they are publicly accessible and creates relevant issues. This gives a more through view of your inventory.
> ℹ️
>
> Only one Azure integration is allowed per Project in ASM.
Adding this integration requires three steps:
1. [Give ASM access to Azure](#give-asm-access-to-azure)
> ℹ️
>
> For this step, you are required to authenticate using an Azure account that has privileges to add an application to the Azure account. This should be one of the following account types:
>
> * Global Administrator
> * Privileged Role Administrator
> * Cloud Application Administrator
> * Application Administrator
2. [Add role assignment for ASM in Azure](#add-role-assignment-for-asm-in-azure)
3. [Connect the integration to the appropriate Collection](#connect-the-integration-to-the-appropriate-collection)
## Give ASM access to Azure
1. From the **Projects and Settings** menu in ASM, select the appropriate Project then click **Account Settings**.
2. Click **Integrations**.
3. Next to Azure, click **Add New**.
4. Click **Connect**.
The system redirects you to the Microsoft sign-in page.
5. Authenticate using an account that has privileges to add an application to the Azure account.\
6\. When authentication is complete, you see a Microsoft screen requesting permission for **Mandiant ASM** to access your Azure instance.
7. Click **Accept** and the system redirects you back to ASM.
## Add role assignment for ASM in Azure
Role assignment can be performed for specific resource groups, or all resource groups in a subscription. This includes any future resource groups that may be added to a subscription. For role assignment, sign in to the Azure Portal and perform the following actions:
> ℹ️
>
> The following screenshots depict the role assignment workflow for resource groups but the process is the same for subscriptions.
1. Browse to [Resource groups](https://portal.azure.com/#blade/HubsExtension/BrowseResourceGroups) (or [Subscriptions](https://portal.azure.com/#blade/Microsoft_Azure_Billing/SubscriptionsBlade)) within Microsoft Azure.
2. For each resource group (or subscription) that you would like to allow ASM to pull data in from, perform the following actions:
1. Click the respective resource group (or subscription).
2. Click **Access control (IAM)**.
3. Within the **Access Control (IAM)** menu, click **Add** and select **Add role assignment**.
4. Select **Role** and choose the **Reader** role for view-only access. Click **Next**.
5. On the **Members** screen, choose the following options:
1. **Assign access to**: **User, group, or service principal**
2. Click **+** **Select members**. When the **Select members** menu opens, search for and select **Mandiant ASM**.
3. Click **Select.**
6. Click **Review + assign**.
7. Ensure that all the information in the **Review + assign** section is correct and click **Review + assign.**
## Connect the integration to the appropriate Collection
Connect the integration to the appropriate Collection**.**
1. Click **Collections** and click  **Collection Settings** for the Collection that you want to connect the integration to.
2. Select the **Integrations** tab.
3. Select **Connect Integration** and **Link** the integration.
The integration is immediately added to the Collection.
### Click  to remove the integration from this Collection. 
4. Click  to close the **Connect Integration** pane. Click **Scan** **Collection** to update your Collection with the current settings and integrations. Otherwise, your newly configured integration is incorporated at your regularly scheduled scan interval.
Repeat the same steps for each resource group or subscription you would like ASM to access.