Microsoft Azure NSG

Overview

This integration isallows designedfor IP addresses to managebe nameddynamically locationsmanaged in Microsoftwithin Azure ConditionalNetwork AccessSecurity policiesGroups via(NSGs), which are used by default as the Microsoftinner Graphfirewalls API.protecting Itvirtual allowsmachines. usersOther toAzure add, delete, or flush named locations related to specific IP addresses. This system can also be used to directly limit access to servicesassets (eg:PaaS outlooketc) versusare teamsmanaged versususing portal)separate through various conditional access policies, as opposed to a blanked policy over Microsoft 365 as a whole, which helps reduce exposure in the event of credential or token loss.Knocs.

An example of a user's experience can be found below:

1. User attempts to access Microsoft 365 services:

   

2. User must authenticate with knocknoc and will see their granted ACL on the right hand side:
   

   

    

3. User can now access Microsoft 365 services:
   

   

Prerequisites

BeforeThis running this script, ensure that you haveutilizes the followingAzure prerequisitesCLI binary, which must be installed andon configured:the Agent machine.

• Powershell - Install the LATEST version of PowerShell on your system. You can check the latest version and instructions for your architecture here: https://github.com/PowerShell/PowerShell/releases/latest 
  
  For Debian, follow these steps:

  # Update the list of packages
  sudo apt-get update
  
  # Install pre-requisite packages.
  sudo apt-get install -y wgetazure-cli
  
  # DownloadUpdate it.
  # If the PowerShellversion packageis filesignificantly wgetbehind, you may need to install from Microsoft (see below)
  az upgrade
  
  # If you have any errors running, you may need to install from Azure directly
  # do this if you get warnings or errors
  #
  #sudo apt remove azure-cli
  #rm -rf ~/.azure
  #curl -sL https://github.com/PowerShell/PowerShell/releases/download/v{latest-version}/powershell_7{latest-version}.deb_amd64.debaka.ms/InstallAzureCLIDeb ###################################
  # Install the PowerShell package| sudo dpkgbash
  
  -i powershell_{latest-version}.deb_amd64.deb
  
  # Resolve missing dependencies and finish the install (if necessary)
  sudo apt-get install -f
  
  # Delete the downloaded package file
  rm powershell_{latest-version}.deb_amd64.deb

Permissions in Azure

To interact with the Azure EnterpriseNSG Application:- Anvia enterprisethe applicationAPI must- beyou createdneed to allow knocknoc to authenticate and change conditional access policies and named locations. Create an enterprise application,first create a clientservice secret,principal and copyassign the application'slimited client id, azure tenant id and secret. You'll need these later.
Note: If you are also using Entrapermissions, as yourshown IdP,below:

make

Create surea thiscustom isrole clearly(for definedlimited inNSG theedit nameaccess)

of

your
1. enterprise

   Go applications.to ForAzure example,Portal: yourhttps://portal.azure.com

   IdP app might be called "knocknoc-saml", and your ACL app might be called "knocknoc-conditionalaccess."
   
   

2. MicrosoftSearch Graphfor API“Subscriptions” Permissions:and Ensureselect thatyour subscription.

3. In the applicationleft hasmenu, click “Access control (IAM)”.

4. Go to the necessary“Roles” tab and click + Add > Add custom role.

5. Basics tab:

   • Name: Knocknoc NSG Edit

   • Description: Can read and edit rules in a Network Security Group.

6. Permissions tab:

   • Click + Add permissions

     to

   • In the search box, type: networkSecurityGroups

   • Add these permissions:

     • Microsoft.Network/networkSecurityGroups/read

     • Microsoft.Network/networkSecurityGroups/securityRules/read

     • Microsoft.Network/networkSecurityGroups/securityRules/write

     • Microsoft.Network/networkSecurityGroups/securityRules/delete

   • Click Add

7. Assignable scopes tab:

   • Click + Add assignable scope

   • Select your resource group, or subscription if broader access theis Microsoft Graph API. For knocknoc to work as intended, two graph API permission are required:
     
     fine.