Skip to content

Set Up an Azure Cloud Connection

To run an Azure Cloud Pentest, you'll first need to connect NodeZero to your Azure tenant and subscriptions.

In the NodeZero Portal, navigate to Pentests > Cloud Connections. On your first visit, you'll see the empty state with a + Connection button.

The Cloud Connections page with a + Connection button in the center.

Create an Azure Connection

Open the Create Form

Click + Connection and select Azure from the modal.

Add Tenant and Subscriptions

Fill in your Tenant Name and Tenant ID. Then add the subscriptions you want to authorize. You have two options:

Add IDs — enter one or more Subscription IDs directly. Click + Add Another Subscription to add more.

Create Azure Connection form with Tenant Name, Tenant ID, and a Subscription ID field under the Add IDs tab.

Upload CSV — switch to the Upload CSV tab and drag-and-drop or browse to a CSV file containing your subscription IDs.

Info

Your CSV must have a column header named id. Each row should contain one subscription ID.

Create Azure Connection form showing the Upload CSV tab with a drag-and-drop zone.

Finding your Subscription IDs

Use Azure Resource Graph Explorer to export all your subscription IDs as a CSV. Run the following query, then click Download as CSV in the Results tab.

ResourceContainers
| where type == "microsoft.resources/subscriptions"
| project id = subscriptionId

Azure Resource Graph Explorer showing the subscription query and a highlighted Download as CSV button.

Once uploaded, the form shows the file name, size, and number of subscriptions detected.

Create Azure Connection form showing an uploaded CSV file with 3 subscriptions detected.

Once you've filled in the form, click Create Connection. You'll be redirected to Azure to grant admin consent.

Review the permissions requested by Horizon3 Cloud Connector and click Accept.

Microsoft permissions requested screen for Horizon3 Cloud Connector, showing the list of requested permissions and an Accept button.

Why does it say 'unverified'?

The Horizon3 Cloud Connector app currently shows as unverified in Microsoft's consent screen. Horizon3 is enrolled in the Microsoft Partner Network (MPN) and the verified publisher badge will appear once our MPN ID is confirmed by Microsoft.

If the consent prompt doesn't appear and you see an error instead, see Admin consent shows AADSTS700016 in the Troubleshooting guide. If you see a Microsoft error page after clicking Accept, see Admin consent returns a Microsoft error page.

After accepting, you'll be redirected back to NodeZero.

Create the Custom Role

NodeZero presents a PowerShell script that creates the "Horizon3 Cloud Connector Custom Role" in your subscriptions. Open Azure Cloud Shell, paste the script, and run it.

Create Azure Connection modal showing the PowerShell script with a Copy button and a Verify button.

Setting up Azure Cloud Shell for the First Time

When you open Cloud Shell, select PowerShell if prompted to choose a shell type.

Welcome to Azure Cloud Shell dialog with Bash and PowerShell options.

If this is your first time using Cloud Shell, you'll also be asked to select a subscription to get started. Choose any subscription and click Apply.

Azure Cloud Shell Getting started dialog with a subscription dropdown and an Apply button.

Once the script finishes, return to NodeZero and click Verify.

Verify the Connection

NodeZero will check that the role was created and that the managed identity can authenticate. Keep the window open while verification runs.

Verify Azure Connection modal showing a Verifying status for the tenant.

Once complete, the status updates to Connected. You can now click Run Pentest or Add Another Tenant if you need to set up additional connections.

Verify Azure Connection modal showing a Connected status with Add Another Tenant and Run Pentest buttons.

What's Next

Your connection now appears on the Cloud Connections page, showing the tenant name, Azure Tenant ID, authorization timestamp, and a table of authorized subscriptions.

Cloud Connections summary page showing the Demo Tenant with its Azure Tenant ID, authorization date, and a table of two subscriptions.

From here you can: