---
title: "Connect Clarity Security to Azure RBAC (AAD add-on)"
slug: "azure-rbac-aad-add-on"
description: "Learn how to connect Clarity Security to Azure RBAC (AAD add-on) to automate your identity life cycle management and user access reviews."
tags: ["Azure Active Directory"]
updated: 2023-05-26T15:05:00Z
published: 2023-05-26T15:05:00Z
canonical: "help.claritysecurity.com/azure-rbac-aad-add-on"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.claritysecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure RBAC (AAD add-on)

This guide will teach you how to set up the connector between [](https://azure.microsoft.com/en-us)[Azure RBAC (AAD add-on)](https://azure.microsoft.com/en-us) and [Clarity Security](https://claritysecurity.io).

**Estimated time to complete: 20** minutes

If you encounter any problems, please contact your support team or [support@claritysecurity.io](mailto:support@claritysecurity.io).

## Supported Connector Capabilities

## 

Below are capabilities supported by the connector at this time.

| **Method** | **Supported** |
| --- | --- |
| Provision User | Yes |
| List Groups, Policies, and Roles | Yes |
| Add User to Groups, Policies, and Roles | Yes |
| Remove User from Groups, Policies, and Roles | Yes |
| Deactivate User | No |
| Delete User | No |

## 

## How to Setup the Connector

### Step 1: Log in to Azure Portal

Azure Portal: [https://portal.azure.com/#home](https://portal.azure.com/#home)

Click through to Azure Active Directory.

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image-1685112849754.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 2: Create a New App Registration

Click on App registrations on the left menu, then New registration

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-05%20at%202.42.36%20PM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 3: Enter a Name and register the app

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-05%20at%209.23.39%20AM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 4: Add a client secret to the app

Click Certificates & secrets on the left, add a Description, and click Add.

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-05%20at%209.26.20%20AM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 5: Copy the Value of the secret

Keep it somewhere for later. You cannot see/copy the value later; you'll have to repeat steps 4 & 5

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-05%20at%209.26.29%20AM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 6: Leave the tab on the Overview for the app

You'll need the Application (client) ID and Directory (tenant) ID later.

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-05%20at%202.55.21%20PM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 7: Open a new tab to the Azure Portal

You'll be assigning a particular Role to this App for all of the Subscriptions where you want to read and/or provision Role Assignments for your Users and Groups.

You can assign this role in individual Subscriptions, or via Management groups. Do not assign the role at the Resource group or Resource level as it will inherit those scopes via the Subscriptions.

Navigate to the first Management group or Subscription to add the Role Assignment for your app.![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image-1685113225510.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 8: Add Role assignments to the App you created

Start by selecting Access control (IAM) and then clicking +Add.

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-06%20at%209.11.45%20AM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

Click Add role assignment:

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-06%20at%209.22.51%20AM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 9: Select the Role "Role Based Access Control Administrator (Preview)"

Search for "Role Based", click the Role Base Access Control Administrator (Preview) role, then click Next.

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-06%20at%209.23.51%20AM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 10: Select Members

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-06%20at%2011.02.57%20AM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 11: Add the App

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-05%20at%209.30.07%20AM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 12: Click "Review + assign" - twice

You may have to click this twice to complete the role assignment.

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-05%20at%209.30.17%20AM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 13: Log in to your Clarity Security tenant

> https://your-tenant.claritysecurity.io/

### Step 14: Click on Applications, then your Azure Active Directory

Note the number in the URL; you'll need this for a later step.

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-06%20at%2011.14.20%20AM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 15: Click on Applications, then Marketplace

![Applications > Marketplace](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image-1679588491503.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 16: Find Azure RBAC (AAD add-on)

Scroll to or search for Azure RBAC (AAD add-on) in the list of applications from the marketplace, then click **Connect**.

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-06%20at%2011.09.49%20AM.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 17: Connect App

Complete the App Settings form. Details for fields common to all applications can be found in the following article: [Common App Configuration Steps](/v1/docs/common-app-steps#step-1-connect-app).

- app_id from step 6 is the Application (client) ID
- app_secret from step 5 is the Value you copied
- tenant from step 6 is the Directory (tenant) ID
- aad_id_in_clarity from step 15

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image-1685113402089.png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 18: App Settings

Complete the App Settings form. Details for each field can be found in the following article: [Common App Configuration Steps](/v1/docs/common-app-steps#step-2-app-settings).

![Configure App Step 2 - App Settings](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Configure%20App%202(3).png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 19: User Settings

Complete the User Settings form, and check the table at the top to see if any features are unsupported. Details for each field can be found in the following article: [Common App Configuration Steps](/v1/docs/common-app-steps#step-3-user-settings).

![Configure App Step 3 - User Settings](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Configure%20App%203(2).png?sv=2026-02-06&spr=https&st=2026-11-09T21%3A32%3A32Z&se=2026-11-09T22%3A32%3A32Z&sr=c&sp=r&sig=9WAzdTSDJLkBN16o1gHss%2BUeYJ6HA97D5Gh5DtrYaX8%3D)

### Step 20: Validate Your Selections and Save

SaveClicking the Save button will trigger the first full sync for your application (even if you selected Manual syncing).  This includes Service Users, Entitlements, Service User Entitlements, Service User Attributes.  

## Need Help?

If you have any problems, contact your customer success team. You can also get in touch with our general support [via email](mailto:support@claritysecurity.io), open a [support ticket](https://support.claritysecurity.com/home). Our general support team is available Monday - Friday from 8:00 AM - 6:30 PM CST.

A Service User is a user, or service account, discovered by Clarity in a downstream application.

An Entitlement is an assignable permission found in a downstream application. Common examples include licenses, groups, and policies.

Service User Entitlements are the pairings of users and active entitlement access in downstream applications.

An attribute is a piece of information used to describe a service user, entitlement, or identity. Common examples include First Name, Last Name, Job Title, Department, etc.