Azure Onboarding Troubleshooting Tips
Having onboarding issues? Use these troubleshooting tips to resolve your onboarding errors.
Onboarding Status
The Onboarding page summarizes onboarding statuses as one of the following:
Status | Description | Action |
|---|---|---|
Complete | Accounts have both resource access and flow log access fully enabled. These accounts are fully onboarded and ready for monitoring and insights. | No action required |
Partially Complete | Accounts have resource access enabled, but flow logs are missing, disabled, or only partially enabled. | Click the Issues column for details and how to troubleshoot. |
Incomplete | Accounts are missing either resource access, flow log access, or both. | Click the Issues column for details and how to troubleshoot. |
To filter the Onboarding Status table, click a status cards at the top of the page.
Onboarding Setup Errors
Onboarding Wizard Did Not Complete
Onboarding Wizard Did Not Complete: Continue your onboarding tasks.
PowerShell Script Execution Pending
If the script is stuck, check for the following:
Azure authentication prompts in the browser
MFA challenges that need completion
Insufficient permissions to create App Registrations
Contact your Azure administrator to resolve permission errors and rerun the script in Azure PowerShell.
App Registration Creation Failed
Make sure that the user has the Application Administrator or Global Administrator role in Azure AD.
Request the necessary role from your Azure AD administrator.
Make sure that the user has Owner or User Access Administrator permissions on the subscription or tenant.
Inventory Onboarding Errors
Credential Error (Status Code 401): Authentication Failed
Open a PowerShell terminal.
Copy the script from the documentation and modify it to include your:
service_account_keysubscription_idcloudsecure_tenant_idservice_account_key
Run the script.
Copy the Send Secrets Back to the Cloud script from the documentation and modify its values to include:
<YourServiceAccountKeyId>: Cloud's service account key id. You can create a Service Account in Settings<YourServiceAccountToken>: Token of the service account being used<Your ClientSecret>: New Service Principals secret<CloudSecureTenantId>: Your Illumio Segmentation for the Cloud TenantId<ClientId>: New Service Principal's Client Id<SubscriptionId>: Azure subscription Id. This is required only for subscription onboarding. If the onboarding type is an Azure tenant, remove the entire line.<AzureTenantId>: Azure Tenant Id of the customer
Run the script.
Rotate the Client Secret
In the Illumio documentation, view Update Service Principals for Onboarded Azure Subscriptions and Tenants.
Copy the Azure onboarding script that matches the access mode you need.
Replace the values in the script with the following from your Service Account credential:
<azure_subscription_id><service_account_key><service_account_token><cs_tenant_id>
In Azure, open a PowerShell Terminal and run the script.
Verify that the script completes.
Service Principal Missing Role Assignment
In the Azure portal, go to Subscriptions, and select the target subscription.
Select Access control (IAM).
Select Add > Add role assignment.
On the Role tab, choose Reader or a custom role that includes the required permissions.
On the Members tab, click + Select members and choose the Illumio service principal.
Click Select.
On the Review + assign tab, click Review + assign.
Flow Errors
Insufficient Permissions
In the Azure portal, go to Storage accounts, and then select your storage account.
In the left pane, select Access control (IAM).
Select Add > Add role assignment.
On the Role tab, select Storage Blob Data Reader.
On the Members tab, click + Select members and choose the Illumio service principal.
Click Select.
In the Review + assign tab, click Review + assign.
If public network access to this storage is restricted:
In the Azure portal, go to Storage accounts and select your storage account.
In the left pane, select Security + networking.
Select Networking.
On the Public access tab, select Manage.
Under Public network access scope, select Enable from selected networks.
In the IPv4 Addresses section, add Illumio's IP addresses.
Click Save.
VNET Flow Logs Not Enabled
In Illumio Console, verify that VNET flow logs are expected but not being received.
Navigate to Azure Portal > Network Watcher > Flow logs.
Check if flow logs are enabled for the required VNETs.
Verify the flow log configuration points to a storage account accessible by Illumio.
VNET Version Incorrect
Navigate to Azure Portal > Network Watcher > Flow logs.
Select the VNET flow log configuration.
Click Edit or Settings.
Change the version to Version 2.
Save the configuration.
Network Security Groups Not Supported
In the Azure portal, go to Network Watcher, and then select Flow logs.
Select Create to add a new flow log.
Configure the flow log:
Select the virtual network (VNET) that contains the target network security group (NSG).
Choose a storage account and ensure that Illumio has the required access.
Set the retention period as needed.
Save the configuration.
Storage Account Firewall Blocking Access
In the Azure portal, go to Storage accounts, and then select your storage account.
In the left pane, select Security + networking.
Select Networking.
On the Public access tab, select Manage.
Under Public network access scope, select Enable from selected virtual networks and IP addresses.
In the IPv4 Addresses section, add Illumio's IP addresses.
Select Save.
Private Endpoint Required
Contact Illumio Support to discuss the private endpoint configuration.
In the Azure portal, go to Storage accounts, and then select your storage account.
In the left pane, select Security + networking.
Select Networking.
On the Private endpoints tab, select Create private endpoint.
Select the private endpoint connection from Illumio, and then approve the connection.
Click Yes.