This article walks you through connecting an Azure account to Cye Cloud Posture Solution with a registered app created by a PowerShell script, for tenants where the recommended OAuth flow is not available.

Overview

Cye Cloud Posture Solution, the Cloud Security Posture Management (CSPM) component of the Cye platform, connects to Azure through a read-only application in your tenant, so it can scan identities, resources, and configuration without elevated privileges. The recommended way to create that application is the OAuth flow in Connecting Your Azure Account (Recommended Way). Use the registered-app flow in this article when OAuth is not available in your tenant: a PowerShell script run in Azure Cloud Shell creates the application and prints the values you paste into the onboarding form.

Run the Script & Register the App: Download azure-onboarding.ps1 from the onboarding page, upload it to Azure Cloud Shell, run it, and paste its output into the onboarding form.
Assign Scope & Role: Grant the new application the Monitoring Reader role on a subscription or a management group. Assigning it at the root management group covers the entire directory.
Verify & Scan: Refresh the subscriptions list on the onboarding page. Connected subscriptions appear within 5 minutes, and your cloud assets are available for inspection within an hour.

Prerequisites

Before you start, make sure you have:

An account with Azure tenant admin permissions.
Access to the Azure Portal.

1. Start a new connection in the console

Every Azure connection starts from the Cloud Accounts page in the Cye Cloud Posture Solution console.

Sign in at console.solvo.cloud and go to Cloud Accounts.
Click Connect account.
Select Connect Azure account, then choose Alternative: registered app.

2. Run the onboarding script

The script creates the registered application in your tenant and prints the values the onboarding form needs.

On the onboarding page, click Download Script to get azure-onboarding.ps1.
Go to https://portal.azure.com/ and sign in with an admin account.
In the top bar of the Azure Portal, open Cloud Shell (PowerShell).
Click Manage files > Upload and select azure-onboarding.ps1.
In Cloud Shell, run:
```
./azure-onboarding.ps1
```
Follow the on-screen instructions. When prompted, complete the device sign-in in your browser.
When the script finishes, copy the displayed values and paste them into the onboarding form.

If the script does not start, make sure you are in the directory where it was uploaded and use ./azure-onboarding.ps1.
Cloud Shell runs PowerShell by default; no extra setup is required.

3. Assign the Monitoring Reader role

The script created an Azure Entra application in your account. That application needs the Monitoring Reader role on every scope you want scanned. Choose the scope that fits your environment: a subscription or a management group.

Tip: For full visibility across your organization, assign the role at the root management group level, which grants access to the entire directory.

Connect an Azure subscription

Go to Subscriptions in the Azure Portal and select the subscription you want to connect.
In the left menu of the selected subscription, select Access control (IAM).
Click Add > Add role assignment.
For Role, select Monitoring Reader (Built-in) and click Next.
For Assign access to, select User, group, or service principal.
Click Select members and search for the application created by the script (commonly named Solvo-Integration, or the name shown in the script output). Select it, click Select, then Next.
Review the settings and click Assign.
Return to the onboarding page in Cye Cloud Posture Solution and refresh the subscriptions list.
Newly connected subscriptions may take up to 5 minutes to appear.

Connect an Azure management group

Go to Management groups in the Azure Portal and select the management group you want to connect.
In the left menu of the selected management group, select Access control (IAM).
Click Add > Add role assignment.
For Role, select Monitoring Reader (Built-in) and click Next.
For Assign access to, select User, group, or service principal.
Click Select members and search for the application created by the script (commonly named Solvo-Integration, or the name shown in the script output). Select it, click Select, then Next.
Review the settings and click Assign.
Return to the onboarding page in Cye Cloud Posture Solution and refresh the subscriptions list.
Newly connected subscriptions under that management group may take up to 5 minutes to appear.

Repeat these steps for each subscription or management group you want to connect.
If you cannot find the application, confirm that the onboarding script completed successfully and that you are in the correct Azure tenant.

Wrap-up / Next Steps

Wait for the first scan: Your cloud assets become available for inspection within an hour after onboarding.
Connect more scopes: Repeat Add role assignment in Access control (IAM) for each additional subscription or management group.
Review what the application can access: See How Cye Cloud Posture Solution Connects to Your Azure Environment for the full list of Microsoft Graph API permissions and the Monitoring Reader role.
Prefer OAuth when it is available: For tenants that support it, follow Connecting Your Azure Account (Recommended Way) instead of the script.

Connecting Your Azure Account with a Registered App