🔷Install IAM assessment on Microsoft Azure

Install the P0 IAM assessment integration on Microsoft Azure to collect IAM data. Required to use Access Inventory and Posture for your Azure subscriptions.

Install the IAM assessment integration to let P0 collect and analyze Azure role assignments, permissions, and resource access for your subscriptions. The assessment also inventories the key and password credentials of service principals that hold role assignments, so Posture can flag stale, expiring, and overprivileged service principal access.

P0 also collects usage signals: the last sign-in activity of users and service principals, and the control-plane actions recorded in the Azure Activity Log. P0 uses these signals to populate Last Used in Access Inventory and to flag unused identities and privileges in Posture.

You must install the IAM assessment integration to use Access Inventory or Posture. P0 builds the identity graph and evaluates posture findings from the data this integration collects. Without it, Inventory and Posture have no data to display.

IAM assessment on Azure is available in beta.

Prerequisites

• Existing P0 account at p0.app.

• One Entra ID directory and at least one subscription on which to install P0.

• A completed Azure app registration. IAM assessment uses the service identity created during app registration.

• The ability to create role assignments. You have this if the Owner role is assigned to your user.

• The ability to grant admin consent for Microsoft Graph application permissions. You have this if the Privileged Role Administrator or Global Administrator role is assigned to your user.

P0 derives the Last Used time for users and service principals from Microsoft Entra sign-in activity, which requires your tenant to hold a Microsoft Entra ID P1 or P2 license. Without a P1 or P2 license, P0 records only the usage it can observe from the Azure Activity Log, so some identities may show Last Used as Unknown.

Install the integration

1. Navigate to Integrations on p0.app, then select Azure.

2. If prompted, enter the ID of the Entra tenant you want to install P0 on.

3. Choose the IAM assessment component.

4. Enter the subscription ID of the subscription you want to assess, then click Next.

5. Review the generated commands. To assess your subscription, P0 needs the built-in Reader role on the subscription, so P0 can collect IAM data, and the following read-only Microsoft Graph permissions, so P0 can inventory directory identities and the app credentials of service principals that hold role assignments:

   Permission	Description
   Group.Read.All	Read all groups
   GroupMember.Read.All	Read group memberships
   User.Read.All	Read all users' full profiles
   RoleManagement.Read.All	Read role management resources
   Reports.Read.All	Read all usage reports
   AuditLog.Read.All	Read all audit log data
   Application.Read.All	Read all application and service principal properties

   Granting the Microsoft Graph permissions requires admin consent.

The IAM assessment integration grants the same Microsoft Graph permissions as the Entra ID directory integration. This lets you install IAM assessment on its own, without first installing the Entra ID integration.

Provision access

The P0 configuration page provides the provisioning commands in two formats. Choose the tab that matches how you manage Azure access:

Shell

1. Copy the commands from the Shell tab on the P0 configuration page. P0 generates a command that adds and admin-consents the Microsoft Graph permissions and a command that assigns the Reader role.

2. Run the commands with the Azure CLI or in Azure Cloud Shell.

The az ad app permission admin-consent command grants tenant-wide admin consent for the Graph permissions. Run it with an account that holds the Privileged Role Administrator or Global Administrator role.

Terraform

1. Copy the configuration from the Terraform tab on the P0 configuration page. P0 generates:

   • An azuread_application_api_access resource that grants the Microsoft Graph permissions to the P0 app registration.

   • An azuread_app_role_assignment resource that grants admin consent for each permission.

   • An azurerm_role_assignment resource that assigns the Reader role on the subscription.

2. Add the configuration to your Terraform project, then run terraform apply.

Applying the azuread_app_role_assignment resources grants tenant-wide admin consent for the Graph permissions. Run terraform apply with credentials that hold the Privileged Role Administrator or Global Administrator role.

Verify the installation

Return to the P0 configuration page and click Next to verify the installation. When verification succeeds, the subscription appears as installed under the IAM assessment component.

Next steps

• Create an environment and run your first scan. See Creating an environment.

• View your results in Access Inventory and Posture.