This guide walks you through creating a Microsoft Entra application, assigning Azure RBAC roles for Network Watcher flow logs, and gathering the configuration needed to create an Azure Network Security integration with Synqly.

Before you begin, ensure that you have:

• Access to the Microsoft Entra admin center with the Application Developer role (or other permissions that allow creating an app registration)
• Access to an Azure subscription with a Network Watcher and flow logs publishing to an Azure Storage account
• Permission to assign Azure RBAC roles to a service principal

1. Sign in to the Microsoft Entra admin center with an account that can create app registrations.
2. Go to Entra ID → App registrations, then select New registration.
3. Enter a Name for the application.
4. For Supported account types, choose Accounts in this organizational directory only (single tenant) unless you need a multi-tenant app. If you are unsure, choose the single-tenant option. For more information, see Tenancy in Microsoft Entra ID.
5. Select Register.
6. On the Overview page, copy the Application (client) ID and Directory (tenant) ID and store them in a safe location.

For more details, see Register an application with the Microsoft identity platform.

1. In the app registration, go to Certificates & secrets → Client secrets.
2. Select New client secret, enter a description and expiration, then select Add.
3. Copy the secret Value immediately and store it with the client ID and tenant ID. You will not be able to view the value again after you leave the page.

Assign the roles from Required Permissions to the application's service principal.

Assign Reader on the Network Watcher scope:

1. In the Azure portal, navigate to the Network Watcher resource (or the resource group or subscription that contains it).
2. Go to Access control (IAM) → + Add → Add role assignment.
3. Search for Reader, select it, and click Next.
4. Click + Select members, add the application from step 1, and click Select.
5. Click Review + assign.

Assign Storage Blob Data Reader on the flow log storage account:

1. In the Azure portal, navigate to the storage account (or container) that receives Network Watcher flow logs.
2. Go to Access control (IAM) → + Add → Add role assignment.
3. Search for Storage Blob Data Reader, select it, and click Next.
4. Click + Select members, add the application from step 1, and click Select.
5. Click Review + assign.

For more details, see Assign Azure roles using the Azure portal.

1. In the Azure portal, navigate to your Network Watcher resource.
2. On the Overview page, note the following values:
   • Subscription ID
   • Resource group
   • Name (Network Watcher name)

Create your integration by supplying the following values.