In some integrations (such as Azure), certain findings exist only at the tenant level — in these cases, a dedicated “parent” company may be needed to connect to the root tenant. Findings stay within each subsidiary, while the parent company sees aggregated metrics.

For such a case we need to create Cye Platform companies per subsidiary + Cye Platform company for the global (tenant level) parent company for which all these companies are connected to.

For full details, see the Group Management guide.

If you are hosting multi business units on the same Azure tenant, you might consider creating:

For additional guidance on integrating Cye Platform with Azure, you may reach out to your TCSM or Cye Platform support.

function ValidateCreatedCredentials

{

param(

[string]$TenantId,

[string]$ClientId,

[string]$ClientSecret

)

Write-Host "Testing credentials with a Graph API call..."

try

{

# Get access token using client credentials flow

$tokenUrl = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"

$body = @{

client_id = $ClientId

scope = "https://graph.microsoft.com/.default"

client_secret = $ClientSecret

grant_type = "client_credentials"

}

$tokenResponse = Invoke-RestMethod -Uri $tokenUrl -Method Post -Body $body -ContentType "application/x-www-form-urlencoded"

$accessToken = $tokenResponse.access_token

# Call Microsoft Graph to get first app

$graphUrl = "https://graph.microsoft.com/v1.0/applications?`$top=1"

$headers = @{

"Authorization" = "Bearer $accessToken"

"Content-Type" = "application/json"

}

$response = Invoke-RestMethod -Uri $graphUrl -Method Get -Headers $headers

if ($response.value.Count -gt 0)

{

Write-Host "Success: API test completed successfully Retrieved app: $( $response.value[0].displayName )"

return $true

}

else

{

Write-Host "Success: API test completed successfully, but no applications were found"

return $true

}

}

catch

{

Write-Host "ERROR: API test failed with: $_"

if ($_.Exception.Response)

{

Write-Host "Status: $( $_.Exception.Response.StatusCode.value__ ) - $( $_.Exception.Response.ReasonPhrase )"

}

return $false

}

}

function HandleExistingApps

{

param(

[string]$AppName,

[int]$Force

)

Write-Host "Checking for existing $AppName applications..."

$olderApps = az ad app list --filter "displayName eq '$AppName'" --query "[].{ObjectId:id, AppId:appId}" -o json | ConvertFrom-Json

$numOfOldApps = $olderApps.Count

$appObjectId = 0

$appId = 0

if ($numOfOldApps -gt 0)

{

if ($Force -eq 1)

{

Write-Host "Deletion might take few seconds"

foreach ($oldAppObjectId in $olderApps)

{

az ad app delete --id $oldAppObjectId.ObjectId

}

Write-Host "Deletion completed"

}

else

{

Write-Host "Using existing app $( $AppName ) found in the directory with Object ID($( $olderApps[0].ObjectId )) and App ID($( $olderApps[0].AppId ))"

Write-Host "To enforce new app creation and delete old $( $AppName ) apps, run the azure-onboarding script again with -force flag"

$appObjectId = $olderApps[0].ObjectId

$appId = $olderApps[0].AppId

}

}

else

{

Write-Host "No existing $AppName applications found or they were deleted"

}

return @{

AppObjectId = $appObjectId

AppId = $appId

}

}

function CreateNewApplication

{

param(

[string]$AppName

)

Write-Host "Configuring new $AppName application..."

$appReg = az ad app create --display-name "$AppName" --query "{ObjectId:id, AppId:appId}" -o json | ConvertFrom-Json

$appObjectId = $appReg.ObjectId

$appId = $appReg.AppId

Write-Host "$AppName application created. Object ID: $appObjectId, App ID: $appId"

# Update application homepage

Write-Host "Updating application data..."

az ad app update --id $appObjectId --web-home-page-url https://www.cyesec.com

return @{

AppObjectId = $appObjectId

AppId = $appId

}

}

function HandleServicePrincipal

{

param(

[string]$CurrentAppId

)

$AppServicePrincipal = az ad sp list --filter "appId eq '$CurrentAppId'" --query '[].{DisplayName:displayName, AppId:appId, Id:id}' -o json | ConvertFrom-Json

if ($AppServicePrincipal.Count -eq 0)

{

$spReg = az ad sp create --id $CurrentAppId --query "{Id:id}" -o json | ConvertFrom-Json

$spId = $spReg.Id

Write-Host "Service principal created. ID: $spId"

}

else

{

Write-Host "Service principal already exists. Display Name: $( $AppServicePrincipal.DisplayName ), App ID: $( $AppServicePrincipal.AppId ), Service Principal ID: $( $AppServicePrincipal.Id )"

$spId = $AppServicePrincipal.Id

}

return $spId

}

function TestGraphApiAccess

{

param(

[string]$TenantId,

[string]$ClientId,

[string]$ClientSecret,

[int]$MaxRetries = 25,

[int]$DelaySeconds = 5

)

Write-Host "Testing credentials..."

$accessToken = $null

$tokenUrl = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"

$body = @{

client_id = $ClientId

scope = "https://management.azure.com/.default"

client_secret = $ClientSecret

grant_type = "client_credentials"

}

for ($attempt = 1; $attempt -le $MaxRetries; $attempt++) {

try

{

$tokenResponse = Invoke-RestMethod -Uri $tokenUrl -Method Post -Body $body -ContentType "application/x-www-form-urlencoded"

$accessToken = $tokenResponse.access_token

if ($accessToken)

{

Write-Host "Access token retrieved successfully"

break

}

Start-Sleep -Seconds $DelaySeconds

}

catch

{

Write-Host "Retrying token retrieval (attempt $attempt of $MaxRetries)"

Start-Sleep -Seconds $DelaySeconds

}

}

if (-not $accessToken)

{

Write-Host "ERROR: Failed to retrieve access token after $MaxRetries attempts"

throw "ERROR: Created credentials are invalid"

}

# Defender for Cloud is read through Azure Resource Graph 'securityresources', not Graph.

$graphUrl = "https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01"

$headers = @{

"Authorization" = "Bearer $accessToken"

"Content-Type" = "application/json"

}

# First: what can this identity read at all? On a first run the Reader role has not been

# assigned yet - that is a later step in the guide, not a failure - so report it and stop

# rather than retrying, and never throw: the caller still has to print the credentials.

$visible = @()

try

{

$subs = Invoke-RestMethod -Uri "https://management.azure.com/subscriptions?api-version=2020-01-01" -Method Get -Headers $headers

$visible = @($subs.value | ForEach-Object { $_.subscriptionId })

}

catch

{

Write-Host "Could not list subscriptions with the new credentials: $_"

return

}

if ($visible.Count -eq 0)

{

Write-Host "No readable subscription yet - the Reader role has not been assigned."

Write-Host "Assign it as described in the guide, then run this script again to verify."

return

}

Write-Host "The application can read $( $visible.Count ) subscription(s)"

# Resource Graph keeps its own cache of role assignments and lags behind ARM by minutes, so

# a freshly assigned Reader returns 403 for a while. That is what this retry loop is for.

for ($attempt = 1; $attempt -le $MaxRetries; $attempt++) {

try

{

Write-Host "Testing credentials with a Resource Graph call (attempt $attempt of $MaxRetries)..."

# Scope the query to those subscriptions. A request naming neither subscriptions nor

# managementGroups runs at tenant scope, which Reader on a management group does not

# authorize, and comes back 403.

$argBody = @{

subscriptions = [string[]]$visible

query = "securityresources | where type =~ 'microsoft.security/assessments' | summarize assessments = count() by subscriptionId"

options = @{ resultFormat = "objectArray" }

} | ConvertTo-Json -Depth 5

$response = Invoke-RestMethod -Uri $graphUrl -Method Post -Headers $headers -Body $argBody

$rows = @($response.data)

Write-Host "API test successful. Readable subscriptions: $( $visible.Count ), assessments: $( ($rows | Measure-Object -Property assessments -Sum).Sum )"

return

}

catch

{

if ($_.Exception.Response)

{

Write-Host "Status: $( $_.Exception.Response.StatusCode.value__ ) - $( $_.Exception.Response.ReasonPhrase )"

}

Write-Host "Retrying API test (attempt $attempt of $MaxRetries)"

Start-Sleep -Seconds $DelaySeconds

}

}

# A failed verification must not destroy the run: the credentials are valid and the caller

# still needs to print them.

Write-Host "WARNING: The Resource Graph check did not succeed. Reader may still be replicating - verify from Cye Platform in a few minutes."

}

function CreateAndValidateApplicationCredentials

{

param(

[string]$CurrentAppObjectId,

[string]$TenantId,

[string]$CurrentAppId,

[int]$ManualConsent

)

$AppYears = (Get-Date).AddYears(50).ToString("yyyy-MM-ddTHH:mm:ssZ")

Write-Host "Creating client secret credential..."

$creds = az ad app credential reset --id $CurrentAppObjectId --end-date $AppYears --query "{Value:password}" -o json --only-show-errors | ConvertFrom-Json

$password = $creds.Value

# Test the credentials

if ($ManualConsent -eq 0)

{

TestGraphApiAccess -TenantId $TenantId -ClientId $CurrentAppId -ClientSecret $password

}

return $password

}

function ExtactArgs

{

param(

[string[]]$Params

)

$appName = "Cye-Defender-for-Cloud"

$force = 0

$skipCred = 0

$manualConsent = 0

if ($Params.Count -gt 0)

{

foreach ($arg in $Params)

{

if ($arg -eq "-force")

{

$force = 1

}

if ($arg -eq "-skipCred")

{

$skipCred = 1

}

if ($arg -like "-manualConsent")

{

$manualConsent = 1

}

if ($arg -like "-appName*")

{

$appName = $arg.Split("=")[1]

}

}

}

return @{

AppName = $appName

Force = $force

SkipCred = $skipCred

ManualConsent = $manualConsent

}

}

#START

$appSettings = ExtactArgs -Params $args

Write-Host "Onboarding script started for $( $appSettings.AppName )"

Write-Host "Fetching Tenant information..."

$tenantId = az account show --query "tenantId" -o tsv

$currentAppInfo = HandleExistingApps -AppName $appSettings.AppName -Force $appSettings.Force

if ($currentAppInfo.AppId -eq 0)

{

$currentAppInfo = CreateNewApplication -AppName $appSettings.AppName

}

$spId = HandleServicePrincipal -CurrentAppId $currentAppInfo.AppId

if ($appSettings.SkipCred -eq 0)

{

$password = CreateAndValidateApplicationCredentials -CurrentAppObjectId $currentAppInfo.AppObjectId -TenantId $tenantId -CurrentAppId $currentAppInfo.AppId -ManualConsent $appSettings.ManualConsent

}

Write-Host "Onboarding script finished successfully"

Write-Host ""

Write-Host "Copy the following parameters to $( $appSettings.AppName ) console"

Write-Host "tenant-id : $tenantId"

Write-Host "client-id : $( $currentAppInfo.AppId)"

Write-Host "client-secret : $password"
​