Prepare Your Azure Account

Updated: July 8, 2026

Want to summarize with AI?

Learn how to prepare an Azure account and subscription for Cisco Multicloud Defense onboarding, including application registration, access, and event notifications.

Prepare your Azure account and subscription(s) before you connect and onboard them to Multicloud Defense Controller with the following steps:

Acquire and register an Azure subscription. Ensure the subscription is associated to the Microsoft Entra ID. Review the list of App Registrations in your Azure portal to confirm whether the subscription is correctly linked to Multicloud Defense.
Create a custom role for your Azure subscription. This grants Multicloud Defense access to specific resources or actions that would otherwise be blocked.
Subscribe to the Azure Event Grid. This allows Multicloud Defense to receive real-time updates and can be configured to send events to subscribers (push) or subscribers can connect to Event Grid to read events (pull). See the "Create event subscriptions" chapter in the Azure User Guide for more information.
Connect an Azure Subscription to the Multicloud Defense Controller from the Multicloud Defense Dashboard. Azure subscriptions encapslulate "technical" resources such as virtual machines. Complete this step to use any Azure-based VMs with Multicloud Defense gateways or any depoyment action.
Accept Marketplace Terms. If this is the first time your Azure account is being onboarded to Multicloud Defense, you must accept Cisco marketplace terms. Without this agreement you cannot complete the onboarding action.
(Optional) User-assigned Managed Identity for Key Vault and Blob Storage access. Configured in the Azure environment, the key vault and blob storage access is intended to give you more flexibility to use the same identity across different resources, maintaining consistent permissions and identities across services.

If you find that you cannot use the automated script, refer to the alternative procedure to manually onboard your account here.

Note

If you have more than one subscription you want to configure with Multicloud Defense, use the procedure in Connect an Azure Subscription to the Multicloud Defense Controller from the Multicloud Defense Dashboard for one subscription and then modify the policy in your Azure portal to add the other subscriptions. You must onboard these subscriptions individually, but you can associate them with Multicloud Defense in bulk.

Register Application in Microsoft Entra ID

Use the following procedure to register the Multicloud Defense application in your Entra ID.

Procedure

	1.	From your Azure portal, navigate to Microsoft Entra ID.
	2.	Select App registrations.
	3.	Click New registration.
	4.	Provide a name to reference the new app registration e.g. Multicloud Defense Controller In the Supported account types choose the second option Accounts in any organizational directory.
	5.	Choose the option appropriate to your organization. Note that the Redirect URI is not needed for the creation of the App registration.
	6.	Click Register.
	7.	In the left navigation bar under the newly created application, click Certificates & secrets.
	8.	Click + New client secret, and then enter the required information in the Add a client secret dialog box Description - Add a description (e.g Multicloud Defense-controller-secret1) Expires - Choose Never. You can also make this selection at your convenience. You will need to create new secrets when the current one expires)
	9.	Click Add. The client secret is populated under the Value column.
	10.	Copy the Client secret into a notepad, as this is shown only once and is never displayed again.
	11.	In the left navigation bar click Overview.
	12.	Copy the Application (client) ID and Directory (tenant) ID into a notepad.

Create a Custom Role to Assign to the Application

The CloudFormation template creates a custom role that will be assigned to the application created for the Multicloud Defense Controller. The custom role gives the application permissions to read inventory information and create resources, for example, VMs, load balancers, etc.

There are multiple ways to create a custom role but we recommend the following procedure:

Procedure

	1.	Navigate to Subscription and click Access Control (IAM).
	2.	Click on Roles and on the top menu bar navigate to click +Add > Add Custom Role.
	3.	Give a name to the custom role, for example, `Multicloud Defense-controller-role`.
	4.	Keep clicking Next until you get to the JSON editing screen.
	5.	Click Edit on the screen and in the JSON text, under the permissions > actions section, copy and paste the provided code content in between the square brackets (no need to maintain the indentation). Note that you are also adding permissions in the Azure role to read role assignments and role definitions, as indicated in the code content. "Microsoft.ApiManagement/service/", "Microsoft.Compute/disks/", "Microsoft.Compute/images/read", "Microsoft.Compute/sshPublicKeys/read", "Microsoft.Compute/virtualMachines/", "Microsoft.ManagedIdentity/userAssignedIdentities/read", "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action", "Microsoft.Network/loadBalancers/", "Microsoft.Network/natGateways/", "Microsoft.Network/networkinterfaces/", "Microsoft.Network/networkSecurityGroups/", "Microsoft.Network/publicIPAddresses/", "Microsoft.Network/routeTables/", "Microsoft.Network/virtualNetworks/", "Microsoft.Network/virtualNetworks/subnets/", "Microsoft.Resources/subscriptions/resourcegroups/", "Microsoft.Storage/storageAccounts/blobServices/", "Microsoft.Storage/storageAccounts/listkeys/action", "Microsoft.Network/networkWatchers/", "Microsoft.Network/applicationSecurityGroups/", "Microsoft.Compute/diskEncryptionSets/read", "Microsoft.Insights/Metrics/Read" "Microsoft.Network/locations/serviceTagDetails/read", "Microsoft.Network/locations/serviceTags/read", "Microsoft.CognitiveServices//read", "Microsoft.CognitiveServices/accounts/listkeys/action", "Microsoft.Network/virtualHubs/", "Microsoft.Network/virtualHubs/hubRouteTables/", "Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/*" "Microsoft.Authorization/roleAssignments/read", "Microsoft.Authorization/roleDefinitions/read"
	6.	Optional - If you plan to use multiple subscriptions with Multicloud Defense, you must edit the JSON at `assignableScopes` to add another subscription line or change it to * (star) so the custom role can be used with all subscriptions.
	7.	Click Save at the top of the text box.
	8.	Click Review + Create and create the role.
	9.	Once the custom role is created, return to Access Control (IAM).
	10.	On the top menu bar, click Add > Add role assignment.
	11.	In the Role dropdown, select the custom role created above.
	12.	In the Assign access to dropdown, leave it as the default (Azure AD user, group, service principal).
	13.	In the Select text box, type in the name of the application created earlier, for example, `Multicloud Defensecontrollerapp`, and click Save.
	14.	In the Subscription page, click on the Overview in the left menu bar and copy the subscription ID to the notepad.

Required Values For Multicloud Defense Controller Onboarding

Connect an Azure Subscription to the Multicloud Defense Controller from the Multicloud Defense Dashboard

Once you prepared the Azure account and subscription as described in the previous sections, you can link it to the Multicloud Defense Controller.

Procedure

	1.	In the Multicloud Defense Controller dashboard, click Add Account in the Cloud Accounts pane.
	2.	On the General Information page, select Azure from the Account Type list box.
	3.	In step 1, follow the instructions to open an Azure Cloud Shell in bash mode.
	4.	In step 2, click the Copy button.
	5.	Run the onboarding script in the bash shell. Note If there is another Azure subscription already connected to Multicloud Defense, this script may fail when creating an IAM role with the same existing name. There cannot be more than one IAM role. As a workaround, run the Bash script with the `-p` prefix. To support spoke VNet protection across subscriptions, onboard subscriptions using Active Directory app registrations.
	6.	Provide a name for this Azure account. You can choose to name this the same as your Azure subscription name. This name is visible on the Multicloud Defense Controller accounts page only.
	7.	(Optional) Provide a description for the subscription.
	8.	Enter the Directory ID, also referred as the Tenant ID.
	9.	Enter the Subscription ID for the subscription being onboarded.
	10.	Enter the Application ID, also referred to as the Client ID, created by the onboarding script.
	11.	Enter the Client Secret, also referred to as the Secret ID.
	12.	Click Save & Continue.

The Azure subscription is onboarded and you are returned to the dashboard to see that the new device has been added.

What to do next

Create a policy in the Azure portal.
VNet Route Tables for your Azure Subscription
Post-Onboarding Procedures.
Enable traffic visiblilty.

Accept Marketplace Terms

Multicloud Defense Controller creates Gateway instances using a Multicloud Defense virtual machine (VM) image from the Azure marketplace. The Terms and Conditions must be accepted for each subscription. Open the Azure cloud shell from the Azure portal website (on the top menubar towards the right side). Choose or switch to bash shell and execute the following command (replace the subscription-id with your subscription id copied in the previous section):

az vm image terms accept --subscription $sub_id --publisher valtix --offer datapath --plan valtix_dp_image

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.