minute read
Configure Azure Files for Audit Record Archiving
Use Microsoft Azure Files to archive audit export records from Imprivata Enterprise Access Management for SSO.
Audit record archiving uses Microsoft Entra ID service principal authentication and Azure role-based access control to write audit export files to an Azure file share.
This integration supports Microsoft Azure Files only. Azure Blob Storage and Azure sovereign cloud environments, including Azure Government and Azure China, are not supported.
Azure Configuration
Use the following steps to create and configure the Azure resources required for audit export.
Step 1. Create the Storage Account
Before you begin, confirm that you have permissions to create and manage Azure storage accounts, file shares, Microsoft Entra ID app registrations, client secrets, and Azure role assignments.
To create the storage account:
-
Go to Microsoft Azure portal.
-
Search for Storage accounts.
-
Select Create.
-
Configure the required storage account settings.
-
For Subscription, select the required subscription.
-
For Resource group, select an existing resource group or create a new one.
-
For Storage account name, enter a globally unique name that uses lowercase letters and numbers.
-
For Region, select a region near the Imprivata appliance.
-
For Primary service, select Azure Files.
-
For Performance, select Standard.
-
For Redundancy, select the redundancy option that meets your organization’s requirements.
-
-
Open the Networking tab.
-
For initial setup, set network access to Enabled from all networks.
-
Open the Data protection tab.
-
Keep the default data protection settings.
-
Select Review + create.
-
Select Create.
Step 2. Create the File Share
-
Open the storage account that you created.
-
Go to Data storage > File shares.
-
Select File share.
-
Enter a name for the file share, such as audit-exports.
-
Set the provisioned storage size that meets your organization’s requirements.
-
Select Create.
Step 3. Create the App Registration
-
In the Microsoft Azure portal, search for App registrations.
-
Select New registration.
-
Enter a name for the app registration, such as EAM-AuditExport.
-
For Supported account types, select Accounts in this organizational directory only.
-
Leave Redirect URI blank.
-
Select Register.
-
Copy the Application (client) ID.
-
Copy the Directory (tenant) ID.
Step 4. Create the Client Secret
-
Open the app registration that you created.
-
Go to Manage > Certificates & secrets.
-
Select New client secret.
-
Enter a description, such as EAM audit exports.
-
Select an expiration that meets your organization’s security policy.
-
Select Add.
-
Copy the client secret value immediately.
NOTE:You cannot retrieve the client secret value after you leave this page. Store the value according to your organization’s credential management policy.
Step 5. Assign the Required Azure Role
-
Open the storage account that you created.
-
Go to Access Control (IAM).
-
Select Add > Add role assignment.
-
On the Role tab, search for and select Storage File Data Privileged Contributor.
-
Select Next.
-
On the Members tab, set Assign access to to User, group, or service principal.
-
Select Select members.
-
Search for the app registration that you created.
-
Select the app registration.
-
Select Review + assign.
Configure Audit Record Archiving
Once Azure is configured:
-
In the Imprivata Admin Console, open the Azure file share configuration settings for audit exports:
-
Enter the Microsoft Entra ID tenant ID.
-
Enter the application client ID.
-
Enter the client secret.
-
Enter the storage account name.
-
Enter the file share name.
-
Enter a path, if required.
-
-
Save the configuration.
-
Run an audit export manually or wait for the next scheduled audit export.
-
In Microsoft Azure, open the storage account and verify that the audit export files are in the file share (Storage Account > File share).
Troubleshooting
Authentication Failure
Authentication can fail when the client secret is invalid or expired.
To resolve the issue, create a new client secret and update the audit export configuration with the new secret value.
Access Denied to the File Share
Access can fail when the app registration does not have the required Azure role assignment.
Verify that the app registration has the Storage File Data Privileged Contributor role assigned at the storage account level.
