> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/environments/creating-an-environment/install-iam-assessment-azure.md).

# Install IAM assessment on Microsoft Azure

Install the **IAM assessment** integration to let P0 collect and analyze Azure role assignments, permissions, and resource access for your subscriptions. The assessment also inventories the key and password credentials of service principals that hold role assignments, so Posture can flag stale, expiring, and overprivileged service principal access.

P0 also collects usage signals: the last sign-in activity of users and service principals, and the control-plane actions recorded in the [Azure Activity Log](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log). P0 uses these signals to populate **Last Used** in Access Inventory and to flag unused identities and privileges in Posture.

{% hint style="warning" %}
You must install the **IAM assessment** integration to use **Access Inventory** or **Posture**. P0 builds the identity graph and evaluates posture findings from the data this integration collects. Without it, Inventory and Posture have no data to display.
{% endhint %}

{% hint style="info" %}
IAM assessment on Azure is available in beta.
{% endhint %}

## Prerequisites

* Existing P0 account at [p0.app](https://p0.app/).
* One Entra ID directory and at least one subscription on which to install P0.
* A completed [Azure app registration](/integrations/resource-integrations/microsoft-azure/azure-app-registration.md). IAM assessment uses the service identity created during app registration.
* The ability to create role assignments. You have this if the [Owner](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged#owner) role is assigned to your user.
* The ability to grant admin consent for Microsoft Graph application permissions. You have this if the [Privileged Role Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#privileged-role-administrator) or [Global Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#global-administrator) role is assigned to your user.

{% hint style="info" %}
P0 derives the **Last Used** time for users and service principals from Microsoft Entra sign-in activity, which requires your tenant to hold a [Microsoft Entra ID P1 or P2](https://learn.microsoft.com/en-us/entra/fundamentals/licensing) license. Without a P1 or P2 license, P0 records only the usage it can observe from the Azure Activity Log, so some identities may show **Last Used** as *Unknown*.
{% endhint %}

## Install the integration

1. Navigate to **Integrations** on [p0.app](https://p0.app), then select **Azure**.
2. If prompted, enter the ID of the Entra tenant you want to install P0 on.
3. Choose the **IAM assessment** component.
4. Enter the **subscription ID** of the subscription you want to assess, then click **Next**.
5. Review the generated commands. To assess your subscription, P0 needs the built-in **Reader** role on the subscription, so P0 can collect IAM data, and the following read-only Microsoft Graph permissions, so P0 can inventory directory identities and the app credentials of service principals that hold role assignments:

   | Permission                | Description                                           |
   | ------------------------- | ----------------------------------------------------- |
   | `Group.Read.All`          | Read all groups                                       |
   | `GroupMember.Read.All`    | Read group memberships                                |
   | `User.Read.All`           | Read all users' full profiles                         |
   | `RoleManagement.Read.All` | Read role management resources                        |
   | `Reports.Read.All`        | Read all usage reports                                |
   | `AuditLog.Read.All`       | Read all audit log data                               |
   | `Application.Read.All`    | Read all application and service principal properties |

   Granting the Microsoft Graph permissions requires admin consent.

{% hint style="info" %}
The IAM assessment integration grants the same Microsoft Graph permissions as the [Entra ID directory integration](/integrations/resource-integrations/microsoft-azure.md). This lets you install IAM assessment on its own, without first installing the Entra ID integration.
{% endhint %}

## Provision access

The P0 configuration page provides the provisioning commands in two formats. Choose the tab that matches how you manage Azure access:

{% tabs %}
{% tab title="Shell" %}

1. Copy the commands from the **Shell** tab on the P0 configuration page. P0 generates a command that adds and admin-consents the Microsoft Graph permissions and a command that assigns the **Reader** role.
2. Run the commands with the [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/) or in [Azure Cloud Shell](https://learn.microsoft.com/en-us/azure/cloud-shell/overview).

{% hint style="info" %}
The `az ad app permission admin-consent` command grants tenant-wide admin consent for the Graph permissions. Run it with an account that holds the Privileged Role Administrator or Global Administrator role.
{% endhint %}
{% endtab %}

{% tab title="Terraform" %}

1. Copy the configuration from the **Terraform** tab on the P0 configuration page. P0 generates:
   * An `azuread_application_api_access` resource that grants the Microsoft Graph permissions to the P0 app registration.
   * An `azuread_app_role_assignment` resource that grants admin consent for each permission.
   * An `azurerm_role_assignment` resource that assigns the **Reader** role on the subscription.
2. Add the configuration to your Terraform project, then run `terraform apply`.

{% hint style="info" %}
Applying the `azuread_app_role_assignment` resources grants tenant-wide admin consent for the Graph permissions. Run `terraform apply` with credentials that hold the Privileged Role Administrator or Global Administrator role.
{% endhint %}
{% endtab %}
{% endtabs %}

## Verify the installation

Return to the P0 configuration page and click **Next** to verify the installation. When verification succeeds, the subscription appears as installed under the **IAM assessment** component.

## Next steps

* Create an environment and run your first scan. See [Creating an environment](/environments/creating-an-environment.md).
* View your results in [Access Inventory](/inventory/access-inventory.md) and [Posture](/posture/posture-overview.md).