Choose your installation path#
The guided Cloud Shell installer creates a dedicated, single-tenant Transilience Managed Compliance application. The manual guide walks your administrators through the same categories of access in the Azure and Entra consoles.
The documented full-evidence profile is azure-full-evidence-v1 with --entra. Azure RBAC is scoped to the subscriptions or management group you select; Graph and Defender for Endpoint application permissions are tenant-wide and require admin consent. These are different approval boundaries.
Decide scope before running the installer#
By default, the guided installer discovers every enabled subscription visible to the signed-in administrator. Narrow it deliberately with the supported subscription-list or management-group options. Verify the intended tenant before creating an application.
An Entra consent administrator may not have Azure RBAC assignment rights, and a subscription Owner may not be able to consent to Graph permissions. Agree the split of responsibilities in advance. Partial grants must be recorded as partial coverage, not a fully healthy connection.
What you will review#
- Azure roles: resource inventory, Defender for Cloud, monitoring, backup, Key Vault metadata, cost, Log Analytics, and Sentinel reading. Conditional roles apply only to the relevant management groups, billing scopes, AKS clusters, and App Configuration stores.
- Microsoft Graph: identity, policies, sign-ins, audit, risk, Intune, and security evidence. These are app-only permissions, not delegated access to the installing administrator.
- Defender for Endpoint: endpoint, vulnerability, software, score, recommendation, and alert evidence.
- A dedicated application credential: a one-year secret in the current installer. Track expiry and use only the approved secure handoff.
Use the permission explorer to search the complete permission manifest. Read-only evidence may include personal data, logs, and configuration values; treat approval as a data-access decision, not just a no-write guarantee.
Access is not the same as telemetry#
Granting API permissions does not license a product, onboard endpoints, create a Sentinel workspace, or configure diagnostic export. Verify evidence coverage after connecting and record unlicensed, unconfigured, or excluded data sources explicitly.