Install an Azure connector on ACI using Azure CLI

Learn how to deploy a connector in an Azure environment

Azure Container Instances (ACI) is a managed, serverless compute platform for running containerized applications. This guide explains how to install and configure an Apono connector on ACI in your Azure environment using Azure CLI.

---

Prerequisites

Item	Description
Apono Token	Account-specific Apono authentication value Use the following steps to obtain your token: On the Connectors page, click Install Connector. The Install Connector page appears. Click Cloud installation > Azure > Install and Connect Azure Account > CLI (Container Instance). Copy the token listed on the page in step 1.
Azure Cloud Command Line Interface (AZ CLI)	Tool that enables interacting with Azure services using your command-line shell
Azure Cloud Information	Information for your Azure Cloud instance: Subscription ID Management Group Name Resource group name
Owner Role (Azure RBAC)	Azure role with the following permissions: Grants full access to manage all resources Assigns roles in Azure RBAC
Global Administrator	The user following this guide should have an Microsoft Entra role with the following permission: Manages all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities ❗Apono does not require Global Administrator access. This is required for the admin following this guide. ❗

---

Install a new connector

You can install a connector for an Azure Management Group or Subscription.

The connector requires the following roles:

1. Directory Readers - to validate users in Azure

2. User Access Administrator - to provision and de-provision access in the Management Group

Read more about these Microsoft Entra ID roles here.

Management Group

Follow these steps to install a new connector:

1. At the shell prompt, set the environment variables.

export APONO_CONNECTOR_ID=<A_UNIQUE_CONNECTOR_NAME>
export APONO_TOKEN=<APONO_TOKEN>
export SUBSCRIPTION_ID=<AZURE_SUBSCRIPTION_ID>
export RESOURCE_GROUP_NAME=<AZURE_RESOURCE_GROUP_NAME>
export MANAGEMENT_GROUP_NAME=<AZURE_MANAGEMENT_GROUP_NAME>

1. Log in to your Azure account.

az login

1. Set the REGION environment variable.

export REGION=$(az group show --name $RESOURCE_GROUP_NAME --query location --output tsv)

1. Run the following command to deploy the connector on your ACI.

export PRINCIPAL_ID=$(az container create --subscription $SUBSCRIPTION_ID --resource-group $RESOURCE_GROUP_NAME --name $APONO_CONNECTOR_ID --ports 80 --os-type linux --image registry.apono.io/apono-connector:v1.7.6 --environment-variables APONO_CONNECTOR_ID=$APONO_CONNECTOR_ID APONO_TOKEN=$APONO_TOKEN APONO_URL=api.apono.io CONNECTOR_METADATA='{"cloud_provider":"AZURE","subscription_id":"'"$SUBSCRIPTION_ID"'","resource_group":"'"$RESOURCE_GROUP_NAME"'","region":"'"$REGION"'","is_azure_admin":true}' --cpu 1 --memory 2 --registry-login-server registry.apono.io --registry-username apono --registry-password $APONO_TOKEN --location $REGION --assign-identity --query identity.principalId --output tsv)

1. Add the User Access Administrator role to the connector in the management group scope.

az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "User Access Administrator" --scope /providers/Microsoft.Management/managementGroups/$MANAGEMENT_GROUP_NAME

1. If your Azure resources have resource locks applied, assign the Tag Contributor role to the connector at the management scope. This allows Apono to add a tag marker during the grant or revoke process.

az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "Tag Contributor" --scope /providers/Microsoft.Management/managementGroups/$MANAGEMENT_GROUP_NAME

1. For Azure AD, add the Directory Readers role to the connector. For Azure AD Groups, add the Groups Administrator and Privileged Role Administrator roles.

Azure AD

az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b", "directoryScopeId": "/"}'

Azure AD Groups

1. On the Connectors page, verify that the connector has been updated.

You can now integrate with an Azure Management Group or Azure Subscription.

Subscription