...
Table | Description |
|---|---|
Authorize It
In Azure Portal, search for Entra ID.
...
Click App registrations in the left menu and click the app (or Service Principal) that you are going to use.
Register the application
openStorage accounts.
...
On the Storage accounts page, selectCreateand name the account.
...
Click “Review + Create” then “Create”After the storage account is created, select it from the list of storage accounts and click onAccess keysin the left menu.
Copy the connection string.
...
Role assignment
Alternatively, users can grant the necessary permissions to the registered application to access the Event Hub without using the RootManageSharedAccessKey. Roles can be assigned in a variety of ways (e.g. inherited from the subscription group), but the following steps will show how to assign the necessary roles directly to the Storage Account.
Repeat steps 1-2 from the Connection String section to create the Storage Account.
In the Storage Account, click Access control (IAM) in the left menu, click + Add, and click Add Role Assignment.
...
...
Search for either the Storage Blob Data Contributor or Storage Blob Data Owner ??Storage Blob Data Reader?? role and select it and then click Next.
...
Click + Select members and search for the event hub application, select it, click Next.
...
Click Review + Assign.
Connection string
Users can either obtain a connection string or use Role Assignments to allow the collector to access the Event Hub.
...
To perform the authorization, the Entra Security Administrator role is required.
Items required before authorizing an Event Hub:
Subscription containing your Azure resources.
Resource group containing your Azure resources.
Name of the region containing Azure resources. Example: East US
Entra directory.
If you have more than one set of these items, then authorize an Event Hub or each set.
Items created or used during the authorization process:
Event hub namespace
Event hub policy
In Azure Portal, search for Entra ID.
Click App registrations in the left menu and click new registration
Register the application
Search for the Event Hubs service and click on it.
Create an Event Hub resource per region (repeat the steps below for each region):
Click Add- Fill the mandatory fields keeping in mind that the Event Hub must be in the same region as the resources that you are going to monitor
Select the subscription and resource group corresponding to the resources that must be monitored.
Enter a name.
In the Location field, select the region containing the resources that must be monitored.
To capture Blob or Data Lake, see How Event Hubs Capture is charged to select a tier. Otherwise, select the cheapest tier and one throughput unit. If you need more resources, they can be added later.
Select “Review+Create,” then “Create.”
- The previous steps create an EventHub namespace; now go
Return to Event Hubs
, search the created one and click on it.
Now click on the + Event Hub button and create a new Event Hub
Add a name.
One partition count is usually enough.
Select the maximum retention time.
Once the Event Hub is created in the namespace, click it and select Consumer Group in the left menu. The
$Defaultconsumer group is fine. Devo recommends that the event hub only be accessed by Devo. If any other entity is accessing the event hub, then each entity must have its own consumer group and Microsoft must be paid more.
Now, in the Event Hub Namespace, click onShared access policies, search the default policy namedRootManageSharedAccessKeyand click it.Copy and write down the primary (or secondary) connection string to be used later in the configuration file.
Click Create.
Role assignment
Alternatively, users can grant the necessary permissions to the registered application to access the Event Hub without using the RootManageSharedAccessKey. Roles can be assigned in a variety of ways (e.g. inherited from the subscription group), but the following steps will show how to assign the necessary roles directly to the Event Hub Namespace.
Repeat all steps except the last one from the previous section to create the Event Hub.
In the Event Hub
Namespace, click and open the namespace created in the previous steps.Select Access control (IAM) in the left menu, click + Add, and click Add Access Role Assignment.
...
Search for
...
the Azure Event Hubs Data Receiver role and select it and then click Next.
Click
...
Select members and search for the previously created App registration.
Select the Application by clicking its name
...
.
Once the application is already listed as a selected member, click Select.
Click Review + Assign.
In the namespace, Create a shared access policy for sending data to the event hub.
...
Search for and select the Monitor service
...
.
Click the Diagnostic Settings option in the left area.
Select a resource
...
Add diagnostic setting
Name the diagnostic setting.
Enable metrics and logs. The options will vary.
Enable “Stream to an event hub.”
Select the namespace, hub, and policy you created.
Click Save
...
.
Switch to the directory.
Add your Entra ID diagnostic settings. Devo recommends enabling all log options
Run It
In the Cloud Collector App, create an Azure Collector instance using this parameters template, replacing the values enclosed in < >.
...