Quick Start Guide¶

Deploy CertifyClouds, give it read access to your Key Vaults and run your first scan.

Prerequisites¶

Before you begin, ensure you have:

• [x] An Azure subscription with Owner or Contributor role
• [x] Azure CLI installed and signed in (az login)
• [x] A CertifyClouds licence key (contact [email protected])
• [x] An Azure Container Registry (ACR) with the CertifyClouds image, imported as described in Installation Step 1
• [x] The CertifyClouds deployment package, which contains the deploy scripts used below
• [x] Two delegated subnets in your VNet, or permission to create them (see Installation Step 2)

Step 1: Deploy CertifyClouds¶

Run the deploy script from the root of the delivered customer package. This example deploys to Azure Container Apps; Installation also covers Azure Container Instances.

./deploy-certifyclouds-cae.sh \
  --name prd \
  --location uksouth \
  --acr-name YOUR_ACR \
  --container-apps-subnet /subscriptions/.../subnets/snet-cae \
  --postgres-subnet /subscriptions/.../subnets/snet-psql

On a new install this first run stops before CertifyClouds starts and prints the access command for Step 2, with the managed identity's principal ID filled in. After Step 2 you run the same deploy command again to start CertifyClouds.

For full deployment instructions, see the Installation Guide.

Step 2: Configure Azure Permissions¶

CertifyClouds needs Reader access to discover Key Vaults and read metadata. The deploy scripts run it as a user-assigned managed identity, id-cc-<region>-<name> in the deployment's resource group.

Get the Managed Identity Principal ID¶

The deploy printed it with the access command. To look it up (Container Apps and Container Instances alike):

PRINCIPAL_ID=$(az identity show \
  --name id-cc-uks-prd \
  --resource-group rg-cc-uks-prd \
  --query principalId -o tsv)

Grant Subscription Reader Role¶

az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role "Reader" \
  --scope /subscriptions/<YOUR_SUBSCRIPTION_ID>

Run the Access Setup Script¶

On Windows, read Running from Windows before running the script.

Run the command the deploy printed for your licence, as someone who is Global Administrator or Privileged Role Administrator in Microsoft Entra ID and Owner or User Access Administrator on the subscriptions. For STARTER it is:

./setup-certifyclouds-access.sh --principal-id $PRINCIPAL_ID --subnet-id $APP_SUBNET_ID --apply

The script path above is relative to the root of the delivered customer package.

This script automatically:

• Discovers all Key Vaults in your subscriptions
• Grants appropriate read permissions
• Adds your subnet to Key Vault firewall rules if needed

Then run the deploy command from Step 1 again. It builds everything else and starts CertifyClouds.

For detailed permissions information, see Azure Permissions.

Step 3: First Sign-in¶

1. Open CertifyClouds in your browser:
2. Container Apps: https://<INTERNAL_FQDN> (from deployment output)

3. ACI: http://<PRIVATE_IP>:8080

4. Sign in as admin with INITIAL_ADMIN_PASSWORD from your .env (a customer package's README shows it too; the deploy never prints it)

5. Change your password: CertifyClouds asks you to set a new one at your first sign-in

Step 4: Add Your Subscription¶

1. Navigate to Settings > Subscriptions
2. Click Refresh from Azure to find the subscriptions CertifyClouds can access
3. Select the subscriptions you want to scan
4. Click Save Selection
5. To verify access, click Test Connection on the home tenant's row in Settings → Access

Step 5: Run Your First Scan¶

1. Go to the Assets tab
2. Click Run Scan
3. Wait for the scan to complete (small estates typically finish under a minute; larger estates take proportionally longer)
4. View your discovered secrets, keys, and certificates

Understanding Scan Results¶

Step 6: Review Compliance Evidence¶

1. Navigate to the Compliance tab
2. Review the current findings with per-rule recommendations
3. Open the Frameworks tab to see how findings map to control families

CertifyClouds aggregates evidence and recommends fixes against:

• HIPAA Security Rule §164.312
• PCI-DSS v4.0
• SOC 2 Type II control families
• ISO 27001 / ISO 27002
• NIST 800-53 Rev. 5
• CIS Azure Foundations Benchmark
• Microsoft Cloud Security Benchmark

For what "evidence" covers and what remains a customer responsibility, see the Compliance Disclaimer.

Step 7: Configure Alerts (Optional)¶

Set up notifications for expiring credentials:

1. Go to Settings > Alerts
2. Click Add Rule
3. Configure:
4. Alert Type: Secrets expiring soon
5. Threshold: 30 days
6. Email: Your ops team email
7. Click Save

What's Next?¶

Troubleshooting¶

"Failed to authenticate with Azure"¶

• Verify managed identity (system-assigned or user-assigned) is enabled
• Check Reader role is assigned on subscriptions
• Run the access setup script again

"Cannot access Key Vault"¶

• Run: ./setup-certifyclouds-access.sh --principal-id $PRINCIPAL_ID
• Check if Key Vault has firewall rules blocking access

"Licence validation failed"¶

• Verify CERTIFYCLOUDS_LICENSE_KEY is set correctly
• Check network access to license.certifyclouds.com

For more help, see Troubleshooting or contact [email protected].