Overview

Azure Organization accounts onboarded to Aqua CSPM through a Management Group use a single service principal credential for discovery and scanning of child subscriptions. When the client secret approaches expiration, rotating credentials incorrectly can interrupt scanning across all onboarded subscriptions.


This article describes the supported rotation workflow for Organization Project accounts, which subscriptions require updates, and validation steps after rotation.


Understanding Organization Project Connections

When CSPM connects to Azure using the Organization (Management Group) method:

  • One Organization Project cloud account in CSPM → Cloud Accounts represents the management-group-level integration.
  • Child Azure subscriptions discovered under that management group inherit the same service principal credentials.
  • Credential updates at the organization level propagate to discovered subscriptions; individual child accounts do not need separate secret updates.

Supported Rotation Procedure

Step 1: Generate a new client secret in Azure

Run the Azure onboarding script (scanner.ps1) documented for Microsoft Azure CSPM integration. The script executes:

az ad sp credential reset --id $servicePrincipal.id

This resets the service principal credential and outputs a new Application ID and Key Value (client secret).

Refer to: CSPM in Microsoft Azure


Step 2: Update the connection in Aqua CSPM

  1. Open CSPM → Cloud Accounts.
  2. Locate the Azure account marked with the Organization Project feature (typically the dedicated CSPM subscription representing the organization connection).
  3. Select Update Connection.
  4. Enter the new Application ID and Key Value from the script output.
  5. Save the update.

Step 3: Validate connectivity

  1. On the same cloud account, use Test Connection to confirm credentials are valid.
  2. Trigger a manual scan or wait for the next scheduled scan and confirm new results appear.
  3. Review the CSPM dashboard for authentication, authorization, or connectivity warnings.
  4. Confirm existing and newly discovered subscriptions under the management group remain visible and scannable.

Important Considerations

TopicGuidance
Which account to updateOnly the Organization Project parent account—not each discovered subscription
Credential propagationUpdating the organization account applies the new secret to all child subscriptions onboarded through that management group
DowntimePlan rotation before secret expiry; brief re-auth may occur during the update window
Script vs. manual Azure portalUsing scanner.ps1 followed by Update Connection is the supported rotation path


Verification and Monitoring

After rotation:

  • Test Connection succeeds on the Organization Project account.
  • Scheduled and on-demand scans complete without authentication errors.
  • No new errors appear for previously onboarded subscriptions.

Platform Coverage


ComponentPlatform
Aqua CSPMSaaS
Cloud providerMicrosoft Azure (Organization / Management Group onboarding)