Microsoft Azure is one of the most widely used cloud platforms, powering critical business operations across industries. By integrating Azure with Hyver, organizations gain continuous visibility into their cloud configuration and security posture.

Once connected, Hyver automatically assesses your Azure environment to identify vulnerabilities and misconfigurations that could put business assets at risk. These assessments run daily with negligible performance impact, ensuring you always have an up-to-date view of your security status.

Before you begin, make sure the following requirements are met:

Note: The PowerShell script (last updated September 2024) must be executed against the tenant root group. This grants Hyver access to all current and future subscriptions automatically.

Important: Creating the Azure integration alone is not enough. You must also create an Azure engagement in Hyver — only then will findings from Azure assessments be generated.

For the integration to work smoothly, you may need to allow traffic from Hyver’s servers in your firewall or network configuration. This ensures that Hyver can securely connect to your environment and perform scans without being blocked.

Depending on your region and the type of scan, add the following IP addresses:

In most cases, you only need to add the IPs relevant to your region and use case.

If your organization includes multiple subsidiaries, Hyver supports a Multi-Company structure for viewing and managing risk across business units.
Where supported, integrations should be created at the subsidiary level, using credentials relevant to each subsidiary’s data.

Integrating Azure with Hyver follows a simple three-part flow. Understanding the framework upfront will make the step-by-step setup much easier:

Before diving into the setup, it’s important to note that Hyver’s Azure integration relies on specific application permissions. These define the level of access granted to Hyver. Full permissions list:

Policy.Read.ConditionalAccess

AppCatalog.Read.All

CustomSecAttributeDefinition.Read.All

ExternalConnection.Read.All

ServicePrincipalEndpoint.Read.All

CloudPC.Read.All

DeviceManagementManagedDevices.Read.All

Device.Read.All

DelegatedAdminRelationship.Read.All

UserAuthenticationMethod.Read.All

Policy.Read.PermissionGrant

SharePointTenantSettings.Read.All

SecurityEvents.Read.All

IdentityRiskyServicePrincipal.Read.All

PrivilegedAccess.Read.AzureAD

RoleManagement.Read.Directory

SecurityAlert.Read.All

Group.Read.All

AdministrativeUnit.Read.All

MailboxSettings.Read

CrossTenantInformation.ReadBasic.All

Sites.Read.All

DeviceManagementServiceConfig.Read.All

DirectoryRecommendations.Read.All

EntitlementManagement.Read.All

IdentityUserFlow.Read.All

Directory.Read.All

ConsentRequest.Read.All

RoleManagement.Read.All

PrivilegedAccess.Read.AzureResources

User.Read.All

Domain.Read.All

SecurityIncident.Read.All

GroupMember.Read.All

DeviceManagementRBAC.Read.All

RoleManagement.Read.CloudPC

CustomSecAttributeAssignment.Read.All

DeviceManagementConfiguration.Read.All

APIConnectors.Read.All

ExternalItem.Read.All

SecurityActions.Read.All

ThreatAssessment.Read.All

IdentityProvider.Read.All

IdentityRiskyUser.Read.All

AccessReview.Read.All

PrivilegedAccess.Read.AzureADGroup

InformationProtectionPolicy.Read.All

Organization.Read.All

IdentityRiskEvent.Read.All

AuditLog.Read.All

Policy.Read.All

Member.Read.Hidden

Application.Read.All

ProgramControl.Read.All

DeviceManagementApps.Read.All

ThreatIndicators.Read.All

Reports.Read.All

ThreatHunting.Read.All

Microsoft Threat Protection

AdvancedHunting.Read.All

Policy.Read.All

Directory.Read.All

Application.Read.All

Member.Read.Hidden

To begin setting up the Azure integration:

Then:

Once these details are filled in, you’re ready to move on to the next stage: authentication, where you’ll choose between the two methods (OAuth or Client ID and Secret).

At this stage, you’ll select how Hyver will authenticate with your Azure tenant. Two authentication options are available:

We’ll walk through each method step by step.

Tenant level authentication.

Check the box that appears, and then click Authenticate:

$roleName = "CYE Azure Integration Reader"

$roleDescription = "Allows CYE to view resources within the Azure Tenant."

$actions = @(

"*/read",

"Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action"

)

$appId = "aaa423c9-336c-4489-aa00-b58f7d46361f"

$mgList = az account management-group list --query "[].id" -o tsv

$rootMgName = az account show --query tenantId -o tsv

if ($mgList) {

$rootMgId = az account management-group show --name $rootMgName --query "id" -o tsv

if ($rootMgId) {

# Create the role definition JSON

$roleDefinition = @{

"Name" = $roleName

"Description" = $roleDescription

"Actions" = $actions

"AssignableScopes" = @($rootMgId)

}

$roleDefinitionJson = $roleDefinition | ConvertTo-Json -Depth 5

az role definition create --role-definition $roleDefinitionJson

az role assignment create --role $roleName --assignee $appId --scope $rootMgId

}

} else {

$subs = az account list --query "[?name!='N/A(tenant level account)'].id" -o tsv

if ($subs) {

foreach ($subId in $subs) {

$roleDefinition = @{

"Name" = "$roleName $subId"

"Description" = $roleDescription

"Actions" = $actions

"AssignableScopes" = @("/subscriptions/$subId")

}

$roleDefinitionJson = $roleDefinition | ConvertTo-Json -Depth 5

az role definition create --role-definition $roleDefinitionJson

az role assignment create --role "$roleName $subId" --assignee $appId --scope "/subscriptions/$subId"

}

}

}

Subscription level authentication. 

Check the box of "Client ID and Secret Authentication":

On the Hyver side, your next steps are to enter the credentials and then create an engagement, which is required for the integration to run. We’ll now walk through both steps in detail:

Once authentication is complete — either via OAuth or Client ID and Secret — you’re ready to move on to Step 3: Creating the engagement and activation.

An engagement defines the scope and context of the Azure assessment in Hyver. Without an engagement, no findings will be generated — even if the integration is already configured.

An engagement specifies:

To review assessment results:

Findings in Azure Engagements

Once the engagement is active, Hyver begins generating findings:

You can remove an Azure integration at any time. Keep in mind that deletion is a two-sided process: the integration must be deleted both in Hyver and in the Azure portal.

Once both actions are completed, the integration is fully removed and Hyver no longer has access to your Azure environment.

In this article, we explored how to connect Microsoft Azure with Hyver to strengthen cloud security visibility. We reviewed the prerequisites, tenant setup, and the two available authentication methods (OAuth or Client ID and Secret). We then walked through creating an Azure engagement to generate findings, and learned how Hyver automatically updates remediation status. Finally, we covered how to delete the integration from both Hyver and the Azure portal. Together, these steps ensure a secure, complete, and maintainable Azure integration.