Step 1: Set up roles and permissions

Learn how to configure an Azure subscription with roles and permissions for connection to Perforce Unified Compliance.

Access is configured via a registered application (Service Principal) in Microsoft Entra ID.

Configure the Service Principals

Configure Service Principals according to the Perforce Unified Compliance capabilities you intend to use:

  • Optimization and cloud virtual machine (VM) discovery (Required):
    Configure a Service Principal with read access to the account and to the storage blob containing the Cost Management Export.

  • VM enrollment in Puppet:
    Configure a Service Principal with both read access and write access permissions, to enable installation of the Puppet agent on the cloud VMs.

For full instructions on configuring Service Principals, see the Microsoft documentation.

Service Principal for optimization and cloud VM discovery

  1. Register the Service Principal with the following details:

    • Name: PuppetCloud-Integration

    • Supported account type: Single tenant

  1. Note the following values, which are required for connection in Perforce Unified Compliance:

    • appId: This is the Application ID required by Perforce Unified Compliance

    • password: This is the Application Secret required by Perforce Unified Compliance

    • tenant: This is the Tenant ID required by Perforce Unified Compliance

  2. Assign the following roles to the Service Principal:

    • Reader at subscription level
      Grants read access to subscription metadata

    • Storage Blob Data Reader (SBDR)
      Authorizes the Service Principal to read the Cost Management export

      For least-privilege access, assign the SBDR role at container level. You might choose to use storage-account scope if you use multiple exports or containers.

      For details, see the Microsoft Azure documentation for built-in roles.

Service Principal for enrolling VMs in Puppet

To install the Puppet agent on cloud VMs, Perforce Unified Compliance uses managed Run Commands. For full details, including prerequisites and version limitations, see the documentation provided by Microsoft for managed Run Commands on Linux VMs and Windows VMs.

  1. Register the Service Principal with the following details:

    • Name: PuppetCloud-Enrollment

    • Supported account type: Single tenant

  1. Note the following values, which are required for connection in Perforce Unified Compliance:

    • appId: This is the Application ID required by Perforce Unified Compliance

    • password: This is the Application Secret required by Perforce Unified Compliance

    • tenant: This is the Tenant ID required by Perforce Unified Compliance

  2. Create a New Client Secret.

    • Set a expiry period of 6 or 12 months.

    • Copy the Client Secret value immediately after it is generated.

      The Client Secret is displayed only once.

  3. Assign the following role to the Service Principal:

    • Virtual Machine Contributor at subscription level
      Grants permissions to enumerate and execute the Run command on VMs to enroll them in Puppet.

      Alternatively, you can use a custom role for Puppet enrollment that includes the following permissions:

      • Microsoft.Compute/locations/runCommands/read

      • Microsoft.Compute/virtualMachines/runCommand/write

      For details, see the Microsoft Azure documentation for built-in roles and custom roles.

Next step

Step 2: Configure the Cost Management export