Azure Requirements
Getting DMC connected to Azure requires three things: a Service Principal for authentication, an RBAC role assignment that controls what DMC can access, and, if you want software inventory, network dependencies, or SQL detection, guest VM access. Work through each section in order. The Service Principal is shared across all Azure scan types.
Create a Service Principal¶
DMC authenticates to Azure using a Service Principal (an App Registration in Microsoft Entra ID). You will enter these four values into DMC when configuring an Azure scan:
| Credential | Where to find it | Format |
|---|---|---|
| Tenant ID | App Registration Overview page: Directory (tenant) ID | UUID |
| Client ID | App Registration Overview page: Application (client) ID | UUID |
| Client Secret | Certificates & secrets, created in step 4 below | String |
| Subscription ID | Subscriptions: Overview page | UUID |
Open App registrations¶
Sign in to the Azure Portal ↗. Navigate to Microsoft Entra ID > App registrations > New registration.
Register the application¶
Enter a name (for example, DMC-Scanner). Under Supported account types, select Accounts in this organizational directory only. Leave Redirect URI blank. Click Register.
Copy your Tenant ID and Client ID¶
On the app registration Overview page, copy both values:
- Application (client) ID: this is the Client ID you enter into DMC
- Directory (tenant) ID: this is the Tenant ID you enter into DMC
Create a client secret¶
Navigate to Certificates & secrets > New client secret. Enter a description (for example, DMC Scan Key) and set an expiry that covers your scan duration. Click Add.
Copy the secret Value immediately after creation. Azure only displays it once. If you navigate away first, you will need to delete the secret and create a new one.
Copy your Subscription ID¶
Navigate to Subscriptions, select the subscription you want to scan, and copy the Subscription ID from the Overview page.
RBAC role¶
Assign the Service Principal the built-in Reader role at the subscription or resource group level. Reader gives DMC everything it needs: VM discovery, Azure Monitor performance metrics, network interface configuration, and Resource Inventory.
| Role | Scope | Enables |
|---|---|---|
Reader | Subscription or Resource Group(s) | VM discovery, Azure Monitor metrics, network interfaces, Resource Inventory |
To assign in the Azure Portal: navigate to the target Subscription (or Resource Group) > Access control (IAM) > Add role assignment. Select Reader and assign it to your App Registration.
Guest-level data (software inventory, network dependencies, SQL detection) is collected over WinRM or SSH and needs no additional RBAC role. See Set up guest VM access below.
How DMC collects guest data: Before scanning, DMC checks WinRM or SSH connectivity to each VM. Where a method is reachable and credentials are supplied, DMC collects guest-level data; otherwise it collects Azure Monitor metrics and VM configuration only and marks the scan as partial.
Network requirements¶
The DMC host needs outbound HTTPS access to Azure APIs. Direct connectivity to VMs is required when using WinRM or SSH.
| Source | Destination | Port | Required for |
|---|---|---|---|
| DMC host | management.azure.com, login.microsoftonline.com | 443 | All scan types: ARM API and authentication |
| DMC host | <region>.metrics.monitor.azure.com | 443 | All scan types: Azure Monitor metrics |
| DMC host | VM private IPs | 5986 / 5985 | WinRM guest access only |
| DMC host | VM private IPs | 22 | SSH guest access only |
Set up guest VM access¶
Guest VM access lets DMC collect software inventory, network dependencies, and SQL Server instances from inside each VM. Configure WinRM on Windows VMs or SSH on Linux VMs.
If no guest access method is available, DMC collects Azure Monitor metrics and VM configuration only and marks the scan as partial.
Windows WinRM¶
DMC connects to Windows VMs via WinRM/PSRP on port 5986 (HTTPS), falling back to 5985 (HTTP). This requires direct network connectivity from the DMC host to each VM and per-VM configuration.
Credential and group requirements
| Account or group | Minimum required | Purpose |
|---|---|---|
| Domain Admin or Local Admin | Interactive login rights | Required to collect system settings, software inventory, active processes, and network dependencies |
| Remote Management Users | Group membership | Enables WinRM connections for remote data collection |
| Performance Monitor Users | Group membership | Allows performance data collection via WMI |
| Performance Log Users | Group membership | Enables performance logging access via WMI |
Being a Local Admin or Domain Admin does not automatically include membership in Remote Management Users, Performance Monitor Users, or Performance Log Users. Verify group membership before running DMC. Usernames can be entered as user/domain or user@domain.com. Both formats are supported.
Enable PowerShell Remoting
Run the following commands as Administrator on each target Windows VM:
Enable PSRemoting¶
Enable-PSRemoting -forceEnable AllowRemoteShellAccess¶
Set-WSManInstance -ResourceURI winrm/config/winrs -ValueSet @{AllowRemoteShellAccess="true"}Disable PowerShell Constrained Language Mode
DMC does not support Constrained Language Mode. Check and disable it if enabled:
Check current mode¶
$ExecutionContext.SessionState.LanguageModeIf the output is FullLanguage, no change is needed. If it shows ConstrainedLanguage, proceed to the next step.
Disable Constrained Language Mode¶
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachineFix UAC token filtering
Even with the correct group memberships, UAC token filtering can silently block DMC from collecting data. Check and disable it if active:
Check the current setting¶
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicyA value of 0 (or a missing key) means filtering is active. Proceed to the next step.
Disable UAC token filtering¶
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /fFor more detail, see Remediating access issues.
Least-privilege account setup
If you prefer not to use a full admin account, the following group memberships are the minimum required:
| Group | Purpose | Alternative |
|---|---|---|
| Remote Management Users | Enables WinRM connections | WinRMRemoteWMIUsers_ |
| Performance Monitor Users | Allows performance data collection via WMI | Required: no alternative |
| Performance Log Users | Enables performance logging via WMI | Required: no alternative |
For Windows Server 2008 and 2008 R2, ensure WMF 3.0 (Windows Management Framework) is installed before running DMC.
Linux SSH¶
DMC connects to Linux VMs via SSH on port 22. This requires direct network connectivity from the DMC host to each VM and a user account with the right permissions.
Authentication
| Method | Fields required |
|---|---|
| Password | Username and password |
| SSH key | Username, private key file (RSA, Ed25519, or ECDSA), and optional passphrase |
Only OpenSSH format private keys are supported. PuTTY .ppk format keys must be converted to OpenSSH format first. See Creating SSH keys for use with DMC.
Passwordless sudo requirements
The scan account needs passwordless sudo access to the following commands on each target VM:
| Command | Purpose | Full path |
|---|---|---|
netstat or ss | Network connection analysis | /usr/bin/netstat, /usr/bin/ss |
ps | Process information | /usr/bin/ps |
ls | File system listing | /usr/bin/ls |
Add an entry like the following to /etc/sudoers on each target VM (replace username with your scan account):
username ALL=(ALL) NOPASSWD: /usr/bin/netstat, /usr/bin/ss, /usr/bin/ps, /usr/bin/lsNOPASSWD is required. DMC runs commands non-interactively over SSH. Also add Defaults:username !requiretty to the sudoers file to allow remote command execution without a TTY session.
On Red Hat and some other distributions, commands may be in different paths than the defaults above. Find the correct path with command -v netstat (or the command name) and use that path in the sudoers file. Verify your configuration works without a TTY: ssh username@host sudo id
Supported guest operating systems¶
Azure Monitor metrics and VM configuration are collected for all VMs regardless of guest OS. Guest-level data (software inventory, network dependencies, SQL detection) requires one of the following supported operating systems:
| Operating system | Guest-level support |
|---|---|
| Windows Server 2008 R2 and above | Full: metrics, software inventory, network dependencies, SQL detection |
| Ubuntu 16.04 LTS and above | Full |
| Red Hat Enterprise Linux 7 and above | Full |
| CentOS 7 and above | Full |
| SUSE Linux Enterprise Server 12 and above | Full |