🔷Install IAM assessment on Microsoft Azure

Install the P0 IAM assessment integration on Microsoft Azure to collect IAM data. Required to use Access Inventory and Posture for your Azure subscriptions.

Install the IAM assessment integration to let P0 collect and analyze Azure role assignments, permissions, and resource access for your subscriptions. The assessment also inventories the key and password credentials of service principals that hold role assignments, so Posture can flag stale, expiring, and overprivileged service principal access.

P0 also collects usage signals: the last sign-in activity of users and service principals, and the control-plane actions recorded in the Azure Activity Log. P0 uses these signals to populate Last Used in Access Inventory and to flag unused identities and privileges in Posture.

You must install the IAM assessment integration to use Access Inventory or Posture. P0 builds the identity graph and evaluates posture findings from the data this integration collects. Without it, Inventory and Posture have no data to display.

IAM assessment on Azure is available in beta.

Prerequisites

• Existing P0 account at p0.app.

• One Entra ID directory and at least one subscription on which to install P0.

• A completed Azure app registration. IAM assessment uses the service identity created during app registration.

• The ability to create role assignments. You have this if the Owner role is assigned to your user.

• The ability to grant admin consent for Microsoft Graph application permissions. You have this if the Privileged Role Administrator or Global Administrator role is assigned to your user.

P0 derives the Last Used time for users and service principals from Microsoft Entra sign-in activity, which requires your tenant to hold a Microsoft Entra ID P1 or P2 license. Without a P1 or P2 license, P0 records only the usage it can observe from the Azure Activity Log, so some identities may show Last Used as Unknown.

Install the integration

1. Navigate to Integrations on p0.app, then select Azure.

2. If prompted, enter the ID of the Entra tenant you want to install P0 on.

3. Choose the IAM assessment component.

4. Enter the subscription ID of the subscription you want to assess, then click Next.

5. Review the generated commands. To assess your subscription, P0 needs two permissions:

   • Application.Read.All on Microsoft Graph, so P0 can inventory the app credentials of service principals that hold role assignments. Granting this permission requires admin consent.

   • The built-in Reader role on the subscription, so P0 can collect IAM data.

Provision access

1. Copy the commands from the P0 configuration page. P0 generates a command to grant and consent the Application.Read.All Graph permission and a command to assign the Reader role.

2. Run the commands with the Azure CLI or in Azure Cloud Shell.

The az ad app permission admin-consent command grants tenant-wide admin consent for the Graph permission. Run it with an account that holds the Privileged Role Administrator or Global Administrator role.

Verify the installation

Return to the P0 configuration page and click Next to verify the installation. When verification succeeds, the subscription appears as installed under the IAM assessment component.

Next steps

• Create an environment and run your first scan. See Creating an environment.

• View your results in Access Inventory and Posture.