Azure is seamlessly integrated into Micetro through cloud integration. For information about how to add Azure services to Micetro, refer to Adding cloud services.
Prerequisites
Before proceeding with Azure configuration, make sure the following prerequisites are met:
- The DNS Agent and DHCP Agent must be on the same machine and capable of connecting to Azure services through the following URLs:
- You need an Azure service principal with appropriate permissions to access
Azure resources managed through Micetro. Add the
following built-in Azure roles to the subscription or specific resource
groups you intend to manage:
- DNS Zone Contributor
- Network Contributor
Retrieve the necessary details for the Azure service principal, including Tenant ID, Subscription ID, Client ID (Application ID), and Client Secret (Authentication Key). For detailed instructions, refer to the Microsoft documentation on how to create a service principal portal.
Minimum permissions for Micetro integration with Azure
To fully integrate Micetro with Azure, the following custom role definition is required. This role covers all necessary permissions for DNS and IPAM. For instructions on creating a custom role, refer to the Azure documentation.
{
"Name": "Men&Mice Operator",
"IsCustom": true,
"Description": "Can manage DNS and IPAM related resources.",
"Actions": [
"Microsoft.Network/dnsZones/*",
"Microsoft.Network/privateDnsZones/*",
"Microsoft.Network/virtualNetworks/read",
"Microsoft.Network/virtualNetworks/write",
"Microsoft.Network/virtualNetworks/delete",
"Microsoft.Network/virtualNetworks/subnets/read",
"Microsoft.Network/virtualNetworks/subnets/write",
"Microsoft.Network/virtualNetworks/subnets/delete",
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Compute/virtualMachines/instanceView/read",
"Microsoft.Network/networkInterfaces/ipConfigurations/read",
"Microsoft.Resources/subscriptions/resourceGroups/read"
],
"AssignableScopes": [
"/subscriptions/<your subscription id or specify a more granular scope>"
]
}Using managed identities
Micetro supports authentication with both system-assigned and user-assigned managed identities instead of secrets, certificates, or other forms of authentication. To use managed identities, the agent must be running on a virtual machine in Azure with managed identities enabled.
When using a user-assigned managed identity, you must also specify the Client ID of the user-assigned managed identity. This ensures that, if a virtual machine has multiple user-assigned managed identities, Micetro can determine which one to use for authentication. For instructions on how to set up managed identities in Azure, refer to Configure managed identities on Azure virtual machines (VMs).