Connect SAP CAL to Azure - Permissions required

[julian_baldner2]

2018-10-1610-14-05.pngHi community,

when we want to connect from SAP Cal to Microsoft Azure there are some permissions needed for the user used to connect.

Internally we have to follow strictly our security guidelines and so it would be great to have2018-10-1610-14-05.png an overview which permissions/access is granted if we accept the terms (as in screenshot).

Thanks,

Julian

[julian_baldner2]

Hi Lyubomira,

maybe I got that question wrong sorry for that, but thanks for the input so far.

We want to understand why SAP is requesting the following privileges:

This is a permission requested to access your data in <Company Name> … what data will be needed ? Why ?

Thanks and best regards,

Julian

[Lyubomira]

Hi Julian,

This is a standard consent dialog from Microsoft Azure how to connect with the external applications which want to use the cloud provider resources and to deploy instances there.
If the selected cloud provider is Microsoft Azure, you have to choose Authorize to establish the connection to this cloud provider and grant permissions to SAP Cloud Appliance Library to access your Azure Active Directory. Then the consent dialog from Microsoft Azure is displayed and you have to choose Accept. After that you will be redirected again to the SAP Cloud Appliance Library to continue with creating an instance.

Best regards,

Lyubomira

[former_member192748]

Hi Julian,

First permission is to allow SAP CAL to setup its own rights in order to not require you to login in Azure anymore and also to allow background processes like scheduling, status refresh and leak detection to work.

Second permission is to allow SAP CAL to work with Azure Resource Manager. This mainly means to be able to manipulate compute, storage and network resources in your Azure Subscription.

Regards,
Nikola

[Lyubomira]

Hi Julian,

We have a community page for FAQs about Microsoft Azure: https://wiki.scn.sap.com/wiki/x/l7qyGw

There you can find this information about the required roles:

What are the roles required by the Microsoft Azure user who will grant permissions to SAP Cloud Appliance Library?

Option 1: You are an administrator on the subscription, i.e. your user has the role Owner and has access to scope /subscriptions/<your subscription ID>.

Option 2: Your Microsoft Azure user has been assigned the role User Access Administrator and has access to scope /subscriptions/<your subscription ID>.

Best regards,

Lyubomira