Grant Optional Permissions to Azure

Azure Role-Based Access Control (RBAC) uses hierarchical scopes defined by Uniform Resource Names (URNs), separated by /.

Some Azure configuration settings exist at the tenant root scope ("/") and under the Microsoft Entra ID provider (Microsoft.aadiam). Microsoft restricts interactions at these scopes.

To allow 365TUNE to:

• Read tenant-level configuration
• Validate security posture
• Execute compliance tests
• Perform Azure configuration assessments

You must assign Reader permissions at:

• Root scope ("/")
• Microsoft Entra ID provider scope (/providers/Microsoft.aadiam)

Prerequisite:

Global Administrator Permissions is required to run the script to grant required permissions in Microsoft Entra ID

Powershell 7 is required

This is required only to temporarily elevate your own access to assign the role at root scop.

Step 1 - Install 365TUNE module

Run command (ignore if already installed)

Install-Module 365TUNE -Scope CurrentUser -force

This step will install 365TUNE's PowerShell module in your Cloud Shell session. (The Cloud Shell session is ephemeral so no files or system changes will persist beyond your current session.)

Step 2 - Invoke Azure connect function

Run command

Invoke-365TuneConnectAzure

This step will:

1. Temporarily elevate your access to the root scope
2. Assign Reader role to 365TUNE at:
   • Root scope ("/")
   • Microsoft Entra ID provider scope
3. Remove your temporary elevated root access

This follows security best practices and least-privilege principles.

Once the Invoke Azure connect function is executed successfully, the security and compliance tests would now include the Azure related tests that were previously skipped.

Alternate Option (PowerShell Script)

To run the script manually, use the below script. Update the $servicePrincipal and $subscription variables. You can use any subscription ID from your tenant.

$servicePrincipal = "<Object ID of the Entra App>" 
$subscription = "<Any Subscription ID from your tenant>" 
Install-Module Az.Accounts -Force 
Install-Module Az.Resources -Force 
Connect-AzAccount 

#Elevate to root scope access 
$elevateAccess = Invoke-AzRestMethod -Path "/providers/Microsoft.Authorization/elevateAccess?api-version=2015-07-01" -Method POST

#Assign permissions to Enterprise App 
New-AzRoleAssignment -ObjectId $servicePrincipal -Scope "/" -RoleDefinitionName "Reader" -ObjectType "ServicePrincipal" 
New-AzRoleAssignment -ObjectId $servicePrincipal -Scope "/providers/Microsoft.aadiam" -RoleDefinitionName "Reader" -ObjectType "ServicePrincipal"

#Remove root scope access 
$assignment = Get-AzRoleAssignment -RoleDefinitionId 18d7d88d-d35e-4fb5-a5c3-7773c20a72d9 | Where-Object { $_.Scope -eq "/" -and $_.SignInName -eq (Get-AzContext).Account.Id }
$deleteAssignment = Invoke-AzRestMethod -Path "$($assignment.RoleAssignmentId)?api-version=2018-07-01" -Method DELETE

To check if the Root scope was removed successfully run below command; StatusCode : 200 or 204 indicates the elevated permissions were removed successfully. 404 indicates the elevation was already removed.

$deleteAssignment.StatusCode