Config Inspection

• 1: Overview
• 2: How-to guides
• 2.1: Dashboard Check
• 2.2: Diagnostic Result Management
• 2.3: Pre-configuration
• 3: Release Note

1 - Overview

Service Overview

Config Inspection is a service that diagnoses the security level of console settings for each service of Samsung Cloud Platform. It provides a security checklist organized by areas such as IAM, Networking, Database, Logging, and checks the current status via API calls to see whether the recommended security settings for each diagnostic item are applied.

Users can create a diagnostic target through service creation and then request a diagnosis, and the diagnosis request results can be checked via the Report. The Report provides the diagnosis request history and item-specific diagnosis results, and for diagnostic items that require the user’s final confirmation or action, detailed results including the resource information corresponding to each item and a remedial guide can be viewed.

Provided Features

Config Inspection provides the following features.

• Console Diagnosis: You can diagnose the security level by calling the Console API using the authentication key method.
• Diagnosis Target Management: Through service creation, you can create and manage the user’s Samsung Cloud Platform account as a diagnosis target.
• Diagnosis Request: In the resource detail screen, you can request a diagnosis by clicking the Diagnosis Request button.
• Diagnostic Result Management: In Report, you can view the list of diagnosis requests and detailed diagnosis results, and download them as an Excel file.

Components

Checklist

The checklist is a collection of diagnostic items that serve as the basis for diagnostic results, and the checklist currently provided by Config Inspection is as follows.

The detailed diagnostic items of the Best Practice checklist provided by Samsung Cloud Platform are as follows.

Report

In the Config Inspection Report, you can view the diagnostic results in the order of result list, result details, and item details.

Preliminary Service

Config Inspection has no preceding service.

2 - How-to guides

The user can enter the required information for the Config Inspection service through the Samsung Cloud Platform Console, select detailed options, and create the service.

Create Certificate

To create and use the Config Inspection service on the Samsung Cloud Platform Console, a prior authentication key generation is required.

Authentication key creation can be done from My Menu > My Info. > Authentication Key Management > Create Authentication Key. For more details, refer to Authentication Key Management.

Config Inspection Create

You can create and use the Config Inspection service in the Samsung Cloud Platform Console.

To create a Config Inspection, follow these steps.

1. All Services > Security > Config Inspection Click the menu. Navigate to Config Inspection’s Service Home page.
2. On the Service Home page, click the Create Config Inspection button. You will be taken to the Create Config Inspection page.
3. Config Inspection creation On the page, enter the inputs required to create the service, and select detailed options.
   • Service Information Input Enter or select the required information in the area.

     Category	Required or not	Detailed description
     Diagnosis Type	-	Automatically set with Console
     Cloud	Required	Select cloud to diagnose SCP: Samsung Cloud Platform AWS: Amazon Web Services Azure: Microsoft Azure Detailed input fields vary depending on the selected cloud type
     Diagnosis Target > Diagnosis Name	Required	Name to distinguish the diagnosis target Use the entered value as the resource name Enter within 25 characters using English letters, numbers, and special characters(-, _)
     Diagnostic Target > Diagnostic Account	Required	Console information for the diagnostic target Select the Account ID to diagnose from the list If the same Account ID is selected, duplicate application occurs and additional charges will be incurred If AWS is selected, enter the Account ID (12 digits) in the diagnostic account If Azure is selected, enter the Subscription ID (36 characters including letters, numbers, and special characters) in the diagnostic account
     Diagnosis Schedule > Checklist	Required	Automatically set when Use Diagnosis Schedule is selected
     Diagnosis Schedule > Diagnosis Cycle	Required	Select Diagnosis Cycle The diagnosis is executed on the selected date according to the specified cycle Monthly is selected, the diagnosis may not be performed on the selected date e.g., selecting the 31st of each month – February has no such date, so the diagnosis is not performed
     Diagnosis Schedule > Start Time	Required	Select Diagnosis Start Time Set the hour and minute information to start the diagnosis
     Authentication Key	Required	Select authentication key to use for Open API calls

     • Click the **Select** button and choose the appropriate authentication key from the list in the **Select Authentication Key** popup.

     • If there are no selectable authentication keys, click **Authentication Key Management** to create a new authentication key.

     • For detailed information about authentication keys, refer to [Manage Authentication Keys](/userguide/management/iam/how_to_guides/myinfo.md/#인증키-관리하기).

     | Plan | Select | Select the plan to use

     • **Standard**: charge based on the number of diagnoses

     • **Monthly flat-rate**: charge a fixed amount each month regardless of the number of diagnoses (based on up to 30 diagnoses per month)

     • The plan cannot be changed after service application

     |

     Table. Config Inspection Service Information Input Items
   • Additional Information Input area, enter or select the required information.

     Category	Required or not	Detailed description
     Tag	Select	Add Tag Up to 50 can be added per resource After clicking the Add Tag button, enter or select Key, Value values

     Table. Config Inspection Additional Information Input Items
4. Summary In the panel, check the detailed information and estimated billing amount you created, and click the Create button.

• When creation is complete, check the created resources on the Config Inspection List page.

Config Inspection Check detailed information

Config Inspection service allows you to view and edit the full resource list and detailed information. Config Inspection detailed page consists of Details, Tags, Work History tabs.

To view detailed information of the Config Inspection service, follow the steps below.

1. All Services > Security > Config Inspection Click the menu. Navigate to Config Inspection’s Service Home page.
2. Click the Config Inspection menu on the Service Home page. You will be taken to the Config Inspection list page.
3. On the Config Inspection List page, click the resource to view detailed information. You will be taken to the Config Inspection Details page.
   • Config Inspection Detailed page displays status information and additional feature information, and consists of Detailed Information, Tags, Work History tabs.

     Category	Detailed description
     Status	Displays the status of Config Inspection Ready: When there is no diagnostic request after service creation (diagnostic request possible) In Progress: When a diagnostic request is in progress (diagnostic request/service termination not possible) Error: When an error occurs in the diagnostic request (diagnostic request possible) Completed: When the diagnostic request is completed successfully (diagnostic request possible)
     Diagnosis Request	Button that can perform Console diagnosis
     Service Cancellation	Button to cancel the service

     Table. Config Inspection status information and additional functions

Detailed Information

Config Inspection List page allows you to view detailed information of the selected resource and, if necessary, edit the information.

Tag

Config Inspection List page allows you to view the tag information of selected resources, and you can add, modify, or delete them.

Work History

On the Config Inspection List page, you can view the operation history of the selected resource.

Config Inspection Resource Management

If you need to view the status of Config Inspection resources and request a diagnosis, you can perform the task on the Config Inspection List or Config Inspection Details page.

Edit Authentication Key

You can select the authentication key to use for diagnosis for each diagnosis target.

To modify the service’s authentication key, follow the steps below.

1. All Services > Security > Config Inspection Click the menu. Go to Config Inspection’s Service Home page.
2. Click the Config Inspection menu on the Service Home page. You will be taken to the Config Inspection list page.
3. Config Inspection List page, click the resource to edit the authentication key. You will be taken to the Config Inspection Details page.
4. Check the authentication key and click the Edit icon. The Edit Authentication Key popup window opens.
5. Edit Authentication Key Select the authentication key to use in the popup window and click the Confirm button.

   Category	Detailed description
   Authentication Key	Authentication Key Details
   Creation Date/Time	Authentication Key Creation Date
   Expiration Date and Time	Authentication Key Expiration Date
   Status	Status of the authentication key Use: Usable state Expired: Expired usage period state

   Table. Authentication Key Edit Popup Items

Request Diagnosis

You can request a console diagnosis based on the configured checklist.

To request a console diagnosis, follow the steps below.

1. All Services > Security > Config Inspection Click the menu. Go to Config Inspection’s Service Home page.

2. Click the Config Inspection menu on the Service Home page. You will be taken to the Config Inspection list page.

3. Config Inspection list page, click the resource to request a diagnosis. Config Inspection details page will be opened.

4. Click the Diagnostic Request button on the Config Inspection Details page. The Diagnostic Request popup will open.

5. Diagnosis Request Enter the information required for diagnosis in the popup window and click the Confirm button.

   • Diagnosis Request The items in the popup window vary depending on the selected Console.

     Category	Detailed description
     Console Access Method	Fixed to authentication key method as the way to access the Console
     Checklist	Fix as Best Practice when selecting SCP
     Authentication Key	If SCP is selected, choose the pre-generated authentication key
     Access Key	Enter Access Key if AWS is selected
     Secret Key	Enter Secret Key if AWS is selected
     Client ID	Enter Client ID if Azure is selected
     Client Secret	Enter Client Secret if Azure is selected
     Tenant ID	Enter Tenant ID if Azure is selected

     Table. Diagnosis Request Popup Items

6. On the Config Inspection List page, check the Status value.

   • When the diagnostic request is completed, the status value is displayed as Completed or Error.
   • Completed: You can view the diagnosis request results in the diagnosis results menu. For more details, see Report Management.

Config Inspection Cancel

You can cancel the unused Config Inspection service. However, if you cancel Config Inspection, all stored diagnostic data will be deleted.

To cancel Config Inspection, follow the steps below.

1. Click the All Services > Security > Config Inspection menu. Go to Config Inspection’s Service Home page.
2. Click the Config Inspection menu on the Service Home page. Navigate to the Config Inspection List page.
3. On the Config Inspection List page, click the resource to be terminated. Navigate to the Config Inspection Details page.
4. Click the Service Termination button on the Config Inspection Details page.
5. When termination is complete, check on the Config Inspection List page whether the resource has been terminated.

2.1 - Dashboard Check

Users can view the diagnostic results of the Config Inspection service at a glance on the dashboard through the Samsung Cloud Platform Console.

Check Dashboard

On the dashboard page, you can view the status of Config Inspection’s diagnostic targets and diagnostic history, etc.

To check the dashboard, follow the steps below.

1. Click the All Services > Security > Config Inspection menu. Navigate to the Service Home page of Config Inspection.
2. Click the Dashboard menu on the Service Home page. Navigate to the Dashboard page.
3. Dashboard Check the summary of diagnostic results on the page.
   • Dashboard You can view the dashboard information at the top of the page based on period or diagnosis name.
     • Period: Based on the current month, you can set a period within 6 months to view summary information of the diagnosis results.
     • Diagnosis Name: If you select All, you can view a summary of the entire diagnostic history results, and if you select a diagnostic account, you can view the detailed information of that diagnostic result.
   • Download button can be clicked to download the information displayed on the dashboard page as a PDF file.

     Category	Detailed description
     Security Level (Overall)	Display average of latest diagnostic results for all diagnostic targets Recent diagnostic results are displayed in the list Diagnostic score calculation formula = Total – (Fail + Error + Check)) / Total x 100
     Periodic Diagnosis Status	Display diagnosis status by target during search period Diagnosis Completed: Show recent completed diagnosis details Diagnosis Error: Show recent diagnosis error details, when selecting diagnosis name go to detailed result page
     Summary of Diagnosis Results by Period (All)	Display summary of diagnosis results (All) during the search period If you select a diagnosis name from the list, you will be taken to the detailed diagnosis result page

     Table. Detailed dashboard item description for overall diagnosis results

     Category	Detailed description
     Security Level	Display the last diagnostic result score of the selected diagnostic account Recent diagnostic results are displayed in the list
     Period-wise diagnostic result summary	Show summary of diagnostic results for the last diagnostic account within the search period
     Vulnerability Status by Period	Display the vulnerability diagnosis results of the diagnostic account during the search period as a graph When a graph is selected, display detailed information of the vulnerable items in the diagnosis results

     Table. Detailed dashboard item description for diagnostic results by diagnostic account

2.2 - Diagnostic Result Management

You can view the Config Inspection diagnostic request results on the diagnostic results page and change the diagnostic results.

Check diagnosis results

On the diagnosis results page, you can view the diagnosis request results.

Check diagnosis result list

To view the list of diagnostic results, follow the steps below.

1. All Services > Security > Config Inspection Click the menu. Navigate to the Service Home page of Config Inspection.
2. Click the Diagnostic Results menu on the Service Home page. You will be taken to the Diagnostic Results List page.
3. Diagnostic Result List Check the summary information of diagnostic results on the page.

   Category	Detailed description
   Diagnosis name	Resource name
   Diagnostic Account	Console information to be diagnosed
   Checklist	Collection of diagnostic items that serve as the basis for diagnostic results
   PASS	Number of items in the checklist with diagnosis result PASS (normal)
   FAIL	Number of items in the checklist with diagnosis result FAIL (vulnerable)
   CHECK	Number of items in the checklist whose diagnosis result is CHECK (verification needed)
   ERROR	Number of items in the checklist whose diagnosis result is ERROR (diagnosis not possible)
   N/A	Number of items in the checklist where the diagnosis result is N/A (not applicable)
   All	Total number of checklist items
   Diagnosis Result	Diagnosis Request Result Completed: The diagnosis request has been successfully completed, clicking Completed moves to the detail page Error: The diagnosis request was not successfully completed, error status items cannot view detailed content
   Diagnosis time	Diagnosis request time

   Table. Diagnosis Result List Items

Check detailed diagnostic result information

To view detailed information of the diagnosis results, follow the steps below.

1. Click the All Services > Security > Config Inspection menu. Navigate to the Service Home page of Config Inspection.
2. Click the Diagnostic Results menu on the Service Home page. It navigates to the Diagnostic Results List page.

• You can search by entering the diagnosis name in the search area of the Diagnosis Result List page or by clicking the Detailed Search button.

3. Click on an item with a Completed diagnosis result on the Diagnosis Result List page. You will be taken to the diagnosis result detail page.

   • Items whose diagnostic result is in error state do not display detailed information.

4. Detailed Diagnosis Results page, check the detailed diagnosis results.

   Category	Detailed description
   Excel Download	Download detailed list of diagnosis results as an Excel file
   More > Diagnosis Result Management	Go to Diagnosis Result Management page
   Checklist	Collection of diagnostic items that serve as the basis for diagnostic results
   Area	Diagnosis scope (services of Samsung Cloud Platform)
   Diagnostic Items	Security standards recommended for service-specific settings
   Result	Result of diagnostic item criteria check

   Table. Detailed Diagnosis Result Items

5. Click the diagnostic item to view detailed information. Diagnostic Item Details popup window opens.

   • Diagnosis Item Details In the popup window, you can view the following information.

     Category	Detailed description
     Area	Diagnosis Scope (Samsung Cloud Platform’s services)
     Diagnostic Items	Security standards recommended for service-specific settings
     Result	Diagnosis item criteria check result
     Diagnosis Criteria	Result Judgment Criteria
     Diagnostic Method	Current Settings Check Method
     Action Guide	Configuration method that meets security standards
     Detailed Result	Resource information and settings corresponding to the diagnostic item
     Diagnosis Result Change	Button to change diagnosis result If the diagnosis result is changed, the Check Result button is displayed, and clicking the Delete button allows deletion of the changed result

     Table. Config Inspection Diagnosis Item Details

Manage Diagnosis Results

On the diagnosis result page, you can change the results of items whose diagnosis result is in CHECK status.

Change Diagnosis Result

To change the diagnosis result, follow the steps below.

1. All Services > Security > Config Inspection Click the menu. Navigate to the Service Home page of Config Inspection.

2. Click the Diagnostic Results menu on the Service Home page. It navigates to the Diagnostic Results List page.

3. Diagnosis Result List page, click the item whose diagnosis result is Completed. You will be taken to the Diagnosis Result Details page.

   • Items with a diagnostic result in error state do not display detailed information.

4. Click the More > Diagnosis Result Management button at the top of the Diagnosis Result Details page. You will be taken to the Diagnosis Result Management page.

5. Click the Result Change button for the item whose diagnostic result you want to modify on the Diagnostic Result Management page. The Result Change popup window will open.

6. Result Change In the popup window, select or enter the information required to change the result.

   Category	Required?	Detailed description
   Registrant	-	Diagnosis result change registrant email
   Validity Period	Required	Set the validity period of the diagnostic result
   Change Result	Required	Select the diagnostic result to change among Pass, Check, Fail
   Detailed Reason	Required	Enter the detailed reason for changing the result
   Attachment File	Select	Upload files required for confirming result changes Attach File button to upload files, up to 5 can be registered
   Inspection Result	-	Detailed inspection result display

   Table. Detailed Items of Diagnosis Result Change

7. Check the entered information and click the Register button. Verify whether the diagnostic results have changed in the Diagnostic Result Management list.

Delete diagnosis result change history

To delete the diagnostic result change history, follow the steps below.

1. All Services > Security > Config Inspection Click the menu. Navigate to Config Inspection’s Service Home page.
2. Click the Diagnostic Results menu on the Service Home page. Navigate to the Diagnostic Results List page.
3. Click an item with a completed diagnosis result on the Diagnosis Result List page. It moves to the Diagnosis Result Details page.
   • Items whose diagnostic result is in error state do not display detailed information.
4. Click the Diagnosis Result Details page’s top Diagnosis Result Management button. It navigates to the Diagnosis Result Management page.
5. Diagnosis Result Management page, click the Check Result button for the item whose diagnosis result you want to change. The Check Result popup window opens.
6. Check Results in the popup window, click the Delete button.

2.3 - Pre-configuration

Users must perform cloud pre-configuration such as authentication key creation and access control IP addition through the Samsung Cloud Platform Console to use the Config Inspection service.

Samsung Cloud Platform Console Settings

To diagnose Samsung Cloud Platform and external clouds in the Config Inspection service, set the following items.

Check Policies Linked to User Group

To check the policy of the user group you belong to, follow the procedure below.

1. Click All Services > Management > IAM menu. You will be redirected to the Service Home page of IAM.
2. Click User Groups menu on the Service Home page. You will be redirected to the User Group List page.
3. Click the user group you want to check on the User Group List page. You will be redirected to the User Group Details page.
4. Click Policies tab on the User Group Details page. You will be redirected to the Policies tab page.
5. Click the policy you want to check on the Policies tab page. You will be redirected to the Policy Details page.
6. Check the detailed information on the Policy Details page.
   • Check if the policy information in the table below is set. If necessary, contact the administrator to add the policy.

     Item	Policy Requirement 1	Policy Requirement 2
     Action	List, Read	Create, Delete, List, Read, Update
     Resource	All resources	Individual resource (Config Inspection)
     Auth Type	All authentication	Temporary key authentication, Console login
     Allowed IP	123.37.11.42, User-defined IP For diagnosis, you must add IP 123.37.11.42 and IP for user console access separately	User-defined IP

     Table. Policy setting details for diagnosing all clouds

Create Authentication Key

You can check and create authentication keys to use in the Config Inspection service.

To create an authentication key in Samsung Cloud Platform Console, follow the procedure below.

1. Click My Menu > My info. menu in the Console. You will be redirected to the My info. details page.
2. Click Authentication Key Management tab on the My info. details page. You will be redirected to the Authentication Key Management tab page.
3. Click Create Authentication Key button on the Authentication Key Management tab page. You will be redirected to the Create Authentication Key page.
   • You can check the authentication key list on the authentication key management page.
4. Enter the expiration period on the Create Authentication Key page and click OK button.
5. Check if the created authentication key is displayed in the authentication key list.

Add Access Allowed IP

You can add access allowed IPs in Samsung Cloud Platform Console.

To add access allowed IPs in the Console, follow the procedure below.

1. Click My Menu > My info. menu in the Console. You will be redirected to the My info. details page.
2. Click Authentication Key Management tab on the My info. details page. You will be redirected to the Authentication Key Management tab page.
3. Click Edit icon in Security Settings item on the Authentication Key Management tab page. The Edit Authentication Key Security Settings popup will open.
4. Enter the authentication method and access allowed IP in the Edit Authentication Key Security Settings popup.
   • Select Authentication Key for authentication method.
   • Set access allowed IP to Enable, enter the IP address, and click Add button.
5. When adding access allowed IP is complete, click OK button. Check if the information is modified to the entered information in the Security Settings item.

AWS Settings

To diagnose AWS (Amazon Web Services) cloud in the Config Inspection service, set the following items.

Add Permission Policy

You can add permission policies for users/user groups in AWS Console.

Add User Permission

To add user access permission policy in AWS Console, follow the procedure below.

1. Click IAM > Users in AWS Console.
2. Select the diagnostic user name from the user list.
3. Click Permissions tab on the user information page.
4. Select Add permissions in the permission policy.
   • Select ReadOnlyAccess, ViewOnlyAccess when adding permissions.

Add User Group Permission

To add user group access permission policy in AWS Console, follow the procedure below.

1. Click IAM > User groups in AWS Console.
2. Select the group the user belongs to from the user group list.
3. Click Permissions tab on the user group page.
4. Select Add permissions in the permission policy.
   • Select ReadOnlyAccess, ViewOnlyAccess when adding permissions.

Add Access Control IP

If using IP access control policy, you must add block exception IPs to that policy.

Add User Access Control IP

To add user access control IP in AWS Console, follow the procedure below.

1. Click IAM > Users in AWS Console.
2. Select the diagnostic user name from the user list.
3. Click Permissions tab on the user information page.
4. Click Edit in IP Access Control Policy in the permission policy item.
   • Add 123.37.24.82 to block exception IP.

Add User Group Access Control IP

To add user group access control IP in AWS Console, follow the procedure below.

1. Click IAM > User groups in AWS Console.
2. Select the group the user belongs to from the user group list.
3. Click Permissions tab on the user group page.
4. Click Edit in IP Access Control Policy in the permission policy item.
   • Add 123.37.24.82 to block exception IP.

Generate Access Key

To generate Access Key in AWS Console, follow the procedure below.

1. Click IAM > Users in AWS Console.
2. Select the diagnostic user name from the user list.
3. Click Security credentials tab on the user information page.
4. Click Access keys on the Security credentials page.
5. Create access keys for third-party services on the Create access key page.
   • Make sure to save the created access key information.

Azure Settings

To diagnose Azure cloud in the Config Inspection service, set the following items.

Register Entra ID Application

To register Entra ID Application in Azure Console, follow the procedure below.

1. Click Microsoft Entra ID > App registrations in Azure Console.
2. Click New registration on the App registrations page.
3. Register application (client) ID.
4. When app registration is complete, check App name, Application (client) ID, Directory (tenant) ID on the overview page.

Add API Permission

To add API permission in Azure Console, follow the procedure below.

1. Click Microsoft Entra ID > App registrations > Entra ID Application registration > created App name > API permissions > Add a permission in Azure Console.
2. Select Microsoft Graph to add permissions from the API permissions list.
3. Click Application permissions on the Request API permissions page.
   • Select Application.Read.All, Device.Read.All, Group.Read.All, User.Read.All, DeviceManagementManagedDevices.Read.All, AuditLog.Read.All, Directory.Read.All, Domain.Read.All, GroupMember.Read.All, Policy.Read.All, Reports.Read.All from the permission list.
4. After adding permissions in App API permission registration, click Grant admin consent for account name.
   • Check if it changes to Granted for account name status for the account name.

Create Client Secret

To create Client Secret in Azure Console, follow the procedure below.

1. Click Microsoft Entra ID > App registrations > Entra ID Application registration > created App name > Certificates & secrets in Azure Console.
2. Click New client secret from the Certificates & secrets list.
3. When client secret is created, check the Client Secret in the Value item from the list.
   • Make sure to save the Client Secret value.

Add Subscription Access Permission in Azure Console

You can add subscription access permissions in Azure Console from Tenant Root Group or individual Subscription. Choose your preferred method to add subscription access permissions.

Add Permission from Tenant Root Group

To add subscription access permission in Azure Console from Tenant Root Group, follow the procedure below.

1. Click Management groups > Overview in Azure Console.
2. Click Tenant Root Group > Access control (IAM).
   • If you cannot enter the Tenant Root Group menu, change the setting below.
     • Change Microsoft Entra ID > Properties > ‘Account name’ can manage access to all Azure subscriptions and management groups in this tenant. > Yes
   • After adding permissions, you must change it to No.
3. Click Add > Add role assignment on the Access control page.
4. Enter detailed information on the Add role assignment page and click Review+assign.
   • When entering role assignment information, select the information below from the Role and Member tabs to add the App created in Entra ID Application registration. You must add all three permissions below.

     Category	Permission
     Reader	Users, group, or service principal
     Key Vault Reader	Users, group, or service principal
     Reader and Data Access	Users, group, or service principal

     Table. Additional permission items when entering role assignment information

Add Permission from Individual Subscription

To add subscription access permission in Azure Console from individual Subscription, follow the procedure below.

1. Click Subscription > Overview in Azure Console.
   • Check Subscription ID from the basic information on the overview page.
2. Click Subscription > Access control (IAM).
3. Click Add > Add role assignment on the Access control page.
4. Enter detailed information on the Add role assignment page and click Review+assign.
   • When entering role assignment information, select the information below from the Role and Member tabs to add the App created in Entra ID Application registration. You must add all three permissions below.

     Category	Permission
     Reader	Users, group, or service principal
     Key Vault Reader	Users, group, or service principal
     Reader and Data Access	Users, group, or service principal

     Table. Additional permission items when entering role assignment information

Add Access Permission via PowerShell

To add subscription access permission in Azure Console using PowerShell, follow the procedure below.

1. Run the following command in Cloud shell > PowerShell in Azure Console.
   • New-AzRoleAssignment -ObjectId “App’s Object ID confirmed in Enterprise Application” -Scope “/providers/Microsoft.aadiam” -RoleDefinitionName ‘Reader’ -ObjectType ‘ServicePrincipal’
   • If the command does not run, change the setting below.
     • Change Microsoft Entra ID > Properties > ‘Account name’ can manage access to all Azure subscriptions and management groups in this tenant. > Yes
     • After adding permissions, you must change it to No
2. Run the following command to check if the setting is complete.
   • Get-AzRoleAssignment –ObjectId ＂App’s Object ID confirmed in Enterprise Application＂ –Scope ＂/providers/Microsoft.aadiam＂
   • If you need to delete permissions, run the following command.
     • Remove-AzRoleAssignment -ObjectId “App’s Object ID confirmed in Enterprise Application” -Scope “/providers/Microsoft.aadiam” -RoleDefinitionName ‘Reader’

3 - Release Note

Config Inspection