Auto Checks Integration Guide for Azure

Important:
You must have admin rights in your Google Cloud environment to complete the setup.
Without sufficient permissions, you won’t be able to assign the necessary roles, enable APIs, or create service accounts.

Why reconfigure?
Since the launch of the Auto Checks feature on June 10th, 2025, Kertos requires additional permissions in your Azure environment.
These permissions go beyond the original Azure integration setup. Without them, Auto Checks cannot scan and validate your cloud configurations against compliance controls.

First Time Setting Up Azure Integration?

If you haven't yet integrated Azure with Kertos, follow our full step-by-step onboarding guide here:
https://docs.kertos.io/en/article/discovery-setup-azure 

Permissions Required

To enable Auto Checks, follow the steps below to grant the required permissions in your Azure environment.

Step 1: Add API Permissions

1. Open the App Registrations in Azure Portal
2. Select your existing Kertos app
3. Go to Manage → API Permissions
4. Click Add a permission → Select Microsoft Graph
5. Choose Application permissions, then add:
6. Domain.Read.All
7. Policy.Read.All
8. UserAuthenticationMethod.Read.All

Step 2: Assign Reader Role to the App

1. Open the Subscriptions page in Azure Portal
2. Select the subscription that contains your cloud assets
3. Copy the Subscription ID and enter it into Kertos
4. Go to Access control (IAM)
5. Click Add → Add role assignment
6. Select the Reader role
7. Click Next, then Select members
8. Search for and select your app (e.g., "Kertos")
9. Click Review + Assign to complete the setup

Once this is complete, don’t forget to enable the "Auto Checks" toggle and run a sync in Kertos.