What Enclave needs
Enclave connects through a multi-tenant Microsoft Entra app that Enclave owns. You grant it two things:- Admin consent for the Enclave app. This includes the Microsoft Graph
Directory.Read.Allpermission, which Enclave uses to read Entra identities such as service principals, applications, and groups. - The Reader role at your tenant root management group. Reader at the root is inherited by every subscription in the tenant, including ones you create later.
Who can run the setup
- To grant admin consent, you need an Entra role that can consent for the whole organization.
- To run the Cloud Shell command, you need permission to create role assignments at the tenant root management group.
- In Enclave, you need the Owner or Admin role.
Connect your tenant
1
Open the setup page
Open Settings → Integrations and click Connect next to Microsoft Azure.
2
Grant admin consent
Under Connect Microsoft, click Connect Microsoft. Sign in as an Entra admin and approve the Enclave app for your organization. Enclave waits for the consent, then shows the next step.
3
Grant tenant-root Reader
Under Grant tenant-root Reader, copy the command. Open Azure Cloud Shell and run it. The command looks like this:
4
Validate
Back in Enclave, click Validate. Enclave checks that it can list your tenant’s subscriptions.
What Enclave discovers
- Infrastructure: every resource in each subscription, read through Azure Resource Graph.
- Network topology: subnets, routes, and firewall rules.
- Identities: role assignments and definitions, managed identities, and Entra service principals, applications, and groups. Enclave links virtual machines and other compute to the managed identities they run as.
Manage a connection
Open Settings → Integrations → Microsoft Azure to see your connected subscriptions.- Re-validate checks that Enclave can still read a subscription.
- Remove stops scanning one subscription.
- Disconnect Azure removes the whole connection and stops scanning.
What Enclave will and won’t do
- Will: read resource configuration and identities with the Reader role and
Directory.Read.All. - Won’t: create, change, or delete resources, or read the contents of your files, secrets, messages, or databases. Enclave doesn’t store a credential for your tenant. Each scan uses short-lived tokens.
Troubleshooting
Validation fails
Validation fails
The Reader role assignment is missing or hasn’t taken effect yet. Run the Cloud Shell command again, wait a minute, then click Revalidate.
The connection shows no subscriptions
The connection shows no subscriptions
If the connection says Tenant validated. Subscriptions are discovered on the next scan., Enclave hasn’t scanned yet. To scan now, click Analyze Environment in Coverage.
Resources appear, but Entra identities don't
Resources appear, but Entra identities don't
Identity discovery needs the
Directory.Read.All consent, which is separate from the Reader role. Grant admin consent to the Enclave app again.