How to Manually Add Missing Prisma Cloud Role Permissions in Azure to Resolve Amber Cloud Account Status
15317
Created On 06/10/22 22:25 PM - Last Modified 04/05/24 23:15 PM
Objective
In this How To you will learn how to manually add missing Prisma Cloud role permissions in Azure to resolve amber cloud account status.
Environment
- Microsoft Azure
- Prisma Cloud
Procedure
If you notice that your Azure cloud account is signaling an amber status, it could be because of missing permissions.
Prisma Cloud and Microsoft Azure update permissions periodically according to new releases.
This may require the customer to manually update their permissions.
Please follow the steps below to remediate the issue:
- Prisma Cloud > Settings > Cloud Accounts > Edit Cloud Account
- Sign in to your Azure Console and go to Management Groups > Click on Tenant Root Groups
- If you have onboarded a singular Azure Subscription, select the subscription.
- Ensure that you have global administrator permissions.
- Click on Access Control(IAM) > Click on + Add > Add Custom Role
- Give a name for custom role and select "Next."
- On the Permissions Screen select > Add Permissions and search for your missing permissions.
- If adding multiple permissions, they will have to be added one at a time.
- Some common ones are the following:
- Microsoft.Network/networkWatchers/securityGroupView/action
- Microsoft.Network/virtualwans/vpnconfiguration/action
- Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action
- Once added hit next and confirm the assignable scopes and hit "Next."
- Review and confirm JSON, if it looks good, hit "Next."
- On the next screen verify that all the information is correct and hit "Create."
- Once the custom role is created, you can add the role assignment to the Prisma Cloud app under Management Groups>Tenant Root Group> Access Control (IAM)> Add Role Assignment
- Search for the role you created and hit "Next."
- Select + Members and search for Prisma Cloud App select "Next" and then select "Review + Assign."
- Once the permission is added, wait at least 4 hours to see if the error goes away in Prisma Cloud.
Additional Information
- Prisma Cloud periodically requires new permissions based on new releases. Release Notes can be seen here .