Skip to content

Create a new Microsoft Azure Application Gateway machine

Creating a machine enables Certificate Manager - SaaS to connect to Microsoft Azure Application Gateway so certificates can be provisioned to the gateway's HTTPS listeners. After creating the machine, you can provision certificates to it.

Before you begin

  • An Azure subscription that contains the Application Gateways you want to manage.
  • A Microsoft Entra ID (Azure AD) service principal with a client secret. The connector authenticates as this service principal.
  • The Network Contributor role assigned to the service principal, scoped to the subscription or to the resource group that contains the target Application Gateways. This role grants both the read and write permissions on Microsoft.Network/applicationGateways that the connector requires.

  • The service principal's Tenant ID, Client ID, and Client Secret, and the Subscription ID.

    Tip

    To create the service principal in the Azure portal, go to Microsoft Entra ID > App registrations > New registration and record the application (client) ID. Then go to Certificates & secrets > New client secret and record the secret value, which is shown only once. Assign the role from Subscriptions > your subscription > Access control (IAM) > Add role assignment.

  1. Enter the Tenant ID. This is the Microsoft Entra (Azure AD) tenant ID.

    Note

    The Tenant ID, Client ID, and Subscription ID must each be a valid UUID: 32 hexadecimal characters with four hyphens.

  2. Enter the Client ID. This is the application (client) ID of the service principal.

  3. Enter the Client Secret. This is the client secret for the service principal.

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  4. Enter the Subscription ID. This is the Azure subscription ID that contains the Application Gateways.

  5. Click Test Access to verify connectivity.

    Note

    The test succeeds when the credentials are valid and the service principal can list Application Gateways. A subscription that contains no Application Gateways still passes the test.

  6. Click Continue. The Continue button is enabled only after the connection test succeeds.

What's next?