SG-Azure is part of ServiceNow developed Service Graph Connectors. The connector is built to simplify the onboarding setup and ease the integration with Azure with the minimum invasive principal. This article describes the concepts and setup of the Service Graph Connector for Azure.

Objectives of SG-Azure –

• Easy to setup
• Should be able to complement the ServiceNow Azure cloud discovery
• Pulls the software details from Azure VMs
• Mid server isn’t required to setup

Azure components and API used

Change Tracking and Inventory

Change Tracking Inventory feature tracks changes in virtual machines hosted in Azure, on-premises, and other cloud environments to help you pinpoint operational and environmental issues with software managed by the Distribution Package Manager

Change Tracking and Inventory natively tracks:

• Software changes
• Windows services
• Linux daemons

** Change Tracking and Inventory Overview

Enabling all features included in Change Tracking and Inventory might cause additional charges. Before proceeding, review Automation Pricing and Azure Monitor Pricing

Azure Graph API

Importing Hardware Cis from Azure

Azure Log Analytics

Log Analytics is a tool in the Azure portal to edit and run log queries from data collected by Azure Monitor logs and interactively analyze their results. We query Azure log analytics workspace to get software information.

Setup on Azure

**Icon source https://azure.microsoft.com/en-in/

Step 1: Create a service principal (i.e. the authentication mechanism)

Steps to register an app:

• Sign into the Azure portal.
• Search for and select Azure Active Directory.
• Under Manage, select App registrations > New registration.
• Enter a display Name for your application.
• Specify who can use the application.
• Select Register to complete the initial app registration.

• Click on the application and select ‘New client secret’
• Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.
• Select API permissions.
• Assign ‘User.Read’ permission in Microsoft Graph API with type ‘Delegated’.
• Assign ‘Data.Read’ permission in Log Analytics API with type ‘Delegated’.
• Select Subscription and select IAM
• Add the application you have created.

Step 2: Create a Log Analytics Workspace

Created workspace for each region under each subscription and noted down the workspace id. Workspace id is required on guided setup for “Create connection for the software import”

Create a Workspace step and note down the workspace id.

Step 3: Create Automation Account

Steps for creating automation account for each region under each subscription

Step 4: Enable Change Tracking and Inventory from an Automation account

Step to enable change tracking

Authentication Flow

1. The client application authenticates to the Azure AD token issuance endpoint and requests an access token.
2. The Azure AD token issuance endpoint issues the access token.
3. The access token is used to authenticate the secured resource.
4. Data from the secured resource is returned to the client application.

Main flow

CI Classes

CI	Table	Azure Terminology
Cloud Service Account	cmdb_ci_cloud_service_account	Subscriptions
Logical Datacenter	cmdb_ci_logical_datacenter	Locations
Availability Zone	cmdb_ci_availability_zone	Availability Sets
Resource Group	cmdb_ci_resource_group	Resource Groups
Cloud Network	cmdb_ci_network	Virtual Networks
Cloud Subnet	cmdb_ci_cloud_subnet	Virtual Networks
Storage Volume	cmdb_ci_storage_volume	Disks
Compute Security Groups	cmdb_ci_compute_security_group	Network Security Groups
Servers	cmdb_ci_server	Virtual Machines
Virtual Server	cmdb_ci_vm_instance	Virtual Machines
Hardware Type	cmdb_ci_compute_template	Virtual Machine Sizes
Cloud Public IP Address	cmdb_ci_cloud_public_ipaddress	Public IP Address
Cloud Mgmt Network Interfaces	cmdb_ci_nic	Network Interfaces
Image	cmdb_ci_os_template	Image
Cloud Storage Account	cmdb_ci_cloud_storage_account	Storage Accounts
Cloud Load Balancer	cmdb_ci_cloud_load_balancer	Load Balancers
Cloud LB Public IP Address	cmdb_ci_cloud_lb_ipaddress	Front End IP or Public IP Address
Software	cmdb_ci_spkg
Software Instance	cmdb_software_instance
Software Installation	cmdb_sam_sw_install