Requirements for Azure Sensor Deployment

• An Azure account with privileges in the resource group or subscriptions that you want to install the USM Anywhere Sensor.
  

• Administrative access to Active Directory (AD) within Azure.
  
  This AD access enables you to create an application required to install resource groups or a subscription for monitoring.
• A virtual network inside the resource group.
• A subnet inside the virtual network.
• A storage account.
  

Sensor Ports and Connectivity

USM Anywhere IP Addresses for Whitelisting

Azure Portal URLs for Proxy Bypass

*.aadcdn.microsoftonline-p.com
*.aka.ms
*.applicationinsights.io
*.azure.com
*.azure.net
*.azureafd.net
*.azure-api.net
*.azuredatalakestore.net
*.azureedge.net
*.loganalytics.io
*.microsoft.com
*.microsoftonline.com
*.microsoftonline-p.com
*.msauth.net
*.msftauth.net
*.trafficmanager.net
*.usgovcloudapi.net (AT&T TDR for Gov only)
*.visualstudio.com
*.windows.net
*.windows-int.net

Deploy the USM Anywhere Sensor from the Azure Marketplace

2. On the page, review the details of the license and click Create.

   This takes you to the Create a virtual machine page, which guides you through the steps for deploying the USM Anywhere Sensor VM.

   

3. On the Basics tab, specify the required fields for the VM:

   • Subscription: Select the subscription into which the USM Anywhere Sensor should be installed.
   • Resource Group: Indicate whether you want to install the USM Anywhere Sensor into an existing resource group or into a new resource group. If new, enter a unique name.
   • Virtual machine name: Enter the name you want to use for the USM Anywhere Sensor VM.
   • Region: Select the region you want to deploy the USM Anywhere Sensor VM.
   • Image: This field is set to Unified Security Management (USM) Anywhere.
   • Size: This field is set to Azure Standard D2 v2.
   • Authentication type: Set this option to specify an SSH public key or a password for SSH access.

   • Username: Enter a username.
     

4. Click Next : Disks.
   
5. On the Disks tab, select Standard SSD as the disk type.
6. Click Next : Networking.

7. On the Networking tab, select the virtual network or subnet upon which the USM Anywhere Sensor VM should be installed. Keep the other defaults.
   

8. Click Review + create to keep the defaults on the remaining tabs.
   
9. On the Review + create tab, review your specifications and the cost summary.

10. Click Create.

    This starts the deployment of the USM Anywhere Sensor, which can take up to six minutes.

11. After deployment finishes, click Go to resource or go to the overview page of the VM and locate its public IP address.

    

12. Paste the IP address into your browser to launch the USM Anywhere Sensor Setup page.
    

Obtain the Azure Subscription ID

1. Log in to the Azure portal (https://portal.azure.com).
2. From the Azure Dashboard, select your subscription.
3. From the Subscription page, copy your subscription ID and save it somewhere that you can access later.

Create the Application in Azure

To create the application in Azure

1. Log in to the Azure portal (https://portal.azure.com).

2. Go to Azure Active Directory > App registrations > New registration.
3. Enter a name for the application.
4. In Supported account types, select Accounts in any organizational directory (Any Azure AD directory - Multitenant).
5. Click Register.

6. After the application is created, you can locate the application(client) ID, directory (tenant) ID, and object ID needed to complete the Azure Credentials step of the sensor setup in USM Anywhere.

   

7. Go to Certificates & secrets and click New client secret.

8. Enter a description for the secret and select a duration.

9. Click Add.

   The value displayed in the Azure portal is the Azure Application Key used by USM Anywhere.
   

Important: Copy this value and save it because you won't be able to copy the key later.

Grant API Permissions

To let your application collect user information in your Azure environment, you need to grant Microsoft Graph API permissions.

To grant API permissions

1. Log in to the Azure portal (https://portal.azure.com) and select your application.

2. Go to API Permissions and click Add a permission.

   

3. Select Microsoft Graph.

4. Select Application permissions and then User.Read.All. Use the search function to help locate the permissions.

   

5. Click Add Permissions.

6. These permissions require admin approval, so make sure to click Grant admin consent for.

   

Associate the Application with the Entire Subscription

If you want to use USM Anywhere to monitor all of your Azure resources, you should associate it with your Azure subscription as a whole.

To associate the application with the entire subscription

1. Log in to the Azure portal (https://portal.azure.com).
2. Go to More Services > Subscriptions, locate the subscription, and select it.

3. Select Access control (IAM) in the navigation list.

   This displays the roles and permissions for the subscription.

   

4. At the top of the page, click Add.

5. Select the Reader role (recommended).

   This role allows assigned users to fetch new Azure logs.
   

6. Select the application you created previously to assign the role to the subscription.
   

7. Click Save and OK.
   

After deploying the Microsoft Azure Sensor, you must connect it to USM Anywhere through registration.

Obtain the Authentication Code

OpenInstructions for USM Anywhere customers:

OpenInstructions for AT&T TDR for Gov customers:

Register Your Sensor

1. Click the public IP address displayed for the running sensor VM in the Azure console.
   

2. Enter a sensor name and sensor description.
3. Paste the authentication code into the field with the key icon ().

4. Click Start Setup to start the process of connecting the USM Anywhere Sensor.

   It takes about 20 minutes to provision your USM Anywhere instance upon registration of your initial sensor. When this instance is provisioned and running, you’ll see a welcome message that provides an access link.

   

   Use this link to open the secured web console for your USM Anywhere instance. You and the other USM Anywhere users in your organization can access this console from a web browser on any system with internet connectivity.
   

Configure the Initial Login Credentials

To configure login credentials

1. In the welcome message, click the link.

   This displays a prompt to set the password to use for the default administrator of USM Anywhere.

2. Enter the password, and then enter it again to confirm.

   Keep in mind these points when you are logging in:

   • The login credentials that you set will apply to any USM Anywhere™ and USM Central™ you have access to.
   • USM Anywhere requires all passwords to have a minimum length of 8 characters and a maximum length of 128 characters.
   • The password must contain numerical digits (0-9).
   • The password must contain uppercase letters (A-Z).
   • The password must contain lowercase letters (a-z).
   • The password must contain special characters, such as hyphen (-) and underscore ( _ ).
     

3. Click Save & Continue.
   

4. When the login page opens, enter the password you just set and click Login.

   

Verify That Your Sensor Is Running

It's a good idea to verify that the USM Anywhere Sensor is running. It also gives you the chance to watch the sensor actively working to find all of your assets and to record events from the start.

To verify that your new sensor is running

1. In USM Anywhere, go to Data Sources > Sensors.

   You should now see your sensor in the page. See USM Anywhere Sensor Management for more information.

   After a few minutes, USM Anywhere locates your assets and starts generating events.

2. You can review the activity in two locations:

   • From the primary task bar, select Environment > Assets.
   • From the primary task bar, select Activity > Events.
     

      

Accessing the Setup Wizard

• After you first log in to the USM Anywhere web user interface (UI) and see the Welcome to USM Anywhere page, click Get Started to launch the Setup Wizard.
  
• If you have already registered one USM Anywhere Sensor but did not complete the setup before logging out, the USM Anywhere Sensor Configuration page launches automatically at your next login to remind you to finalize configuration of the sensor. From that page, you click Configure to launch the Setup Wizard and complete the sensor configuration.
• If you registered an additional USM Anywhere Sensor, but did not complete the setup, the Sensors page displays an error () in the Configured column. See Sensors Page Overview for more information.
  
• Go to Data Sources > Sensors, and then click the sensor name to complete the sensor configuration. See USM Anywhere Sensor Management for more information.
  

Configuring the Azure Sensor in the Setup Wizard

Azure Credentials

Azure Configuration