Table: azure_tenant - Query Azure Tenants using SQL
Azure Tenants represent an organization in Azure. Each organization has at least one tenant, and each Azure subscription is associated with a tenant. Tenants are used to manage access to Azure resources.
Table Usage Guide
The azure_tenant
table provides insights into the organizations associated with Azure subscriptions. As a Cloud Administrator, you can use this table to explore details such as tenant IDs and domains. This information can be useful for managing access to Azure resources and for understanding the organizational structure of your Azure subscriptions.
Examples
Basic info
Discover the segments that are part of your Azure tenant, including their geographical location and associated domains. This is useful for understanding the distribution and categorization of your Azure resources.
select name, id, tenant_id, tenant_category, country, country_code, display_name, domainsfrom azure_tenant;
select name, id, tenant_id, tenant_category, country, country_code, display_name, domainsfrom azure_tenant;
Control examples
- All Controls > Active Directory > Ensure guest users are reviewed on a monthly basis
- All Controls > Active Directory > Ensure Multi-factor Authentication is required for Azure Management
- All Controls > Active Directory > Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- All Controls > Active Directory > Ensure that 'Users Can Create Tenants' is set to 'No'
- All Controls > Active Directory > Ensure that 'Users Can Register Applications' is set to 'No'
- All Controls > Active Directory > IAM users should not have built in contributor role
- Blocked accounts with owner permissions on Azure resources should be removed
- Blocked accounts with read and write permissions on Azure resources should be removed
- CIS v1.3.0 > 1 Identity and Access Management > 1.3 Ensure guest users are reviewed on a monthly basis
- CIS v1.4.0 > 1 Identity and Access Management > 1.3 Ensure guest users are reviewed on a monthly basis
- CIS v1.5.0 > 1 Identity and Access Management > 1.14 Ensure That ‘Users Can Register Applications’ Is Set to ‘No’
- CIS v1.5.0 > 1 Identity and Access Management > 1.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- CIS v1.5.0 > 1 Identity and Access Management > 1.2 Conditional Access > 1.2.6 Ensure Multi-factor Authentication is Required for Azure Management
- CIS v1.5.0 > 1 Identity and Access Management > 1.4 Ensure Guest Users Are Reviewed on a Regular Basis
- CIS v2.0.0 > 1 Identity and Access Management > 1.14 Ensure That 'Users Can Register Applications' Is Set to 'No'
- CIS v2.0.0 > 1 Identity and Access Management > 1.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- CIS v2.0.0 > 1 Identity and Access Management > 1.2 Conditional Access > 1.2.6 Ensure Multi-factor Authentication is Required for Azure Management
- CIS v2.0.0 > 1 Identity and Access Management > 1.5 Ensure Guest Users Are Reviewed on a Regular Basis
- CIS v2.1.0 > 1 Identity and Access Management > 1.13 Ensure That 'Users Can Register Applications' Is Set to 'No'
- CIS v2.1.0 > 1 Identity and Access Management > 1.18 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- CIS v2.1.0 > 1 Identity and Access Management > 1.2 Conditional Access > 1.2.6 Ensure Multifactor Authentication is Required for Windows Azure Service Management API
- CIS v2.1.0 > 1 Identity and Access Management > 1.25 Ensure fewer than 5 users have global administrator assignment
- CIS v2.1.0 > 1 Identity and Access Management > 1.4 Ensure Guest Users Are Reviewed on a Regular Basis
- Guest accounts with owner permissions on Azure resources should be removed
- Guest accounts with read permissions on Azure resources should be removed
- Guest accounts with write permissions on Azure resources should be removed
Schema for azure_tenant
Name | Type | Operators | Description |
---|---|---|---|
_ctx | jsonb | Steampipe context in JSON form. | |
akas | jsonb | Array of globally unique identifier strings (also known as) for the resource. | |
cloud_environment | text | The Azure Cloud Environment. | |
country | text | Country/region name of the address for the tenant. | |
country_code | text | Country/region abbreviation for the tenant. | |
display_name | text | The list of domains for the tenant. | |
domains | jsonb | The list of domains for the tenant. | |
id | text | The fully qualified ID of the tenant. For example, /tenants/00000000-0000-0000-0000-000000000000. | |
name | text | The display name of the tenant. | |
sp_connection_name | text | =, !=, ~~, ~~*, !~~, !~~* | Steampipe connection name. |
sp_ctx | jsonb | Steampipe context in JSON form. | |
subscription_id | text | =, !=, ~~, ~~*, !~~, !~~* | The Azure Subscription ID in which the resource is located. |
tenant_category | text | The tenant category. Possible values include: 'Home', 'ProjectedBy', 'ManagedBy'. | |
tenant_id | text | The tenant ID. For example, 00000000-0000-0000-0000-000000000000. | |
title | text | Title of the resource. |
Export
This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- azure
You can pass the configuration to the command with the --config
argument:
steampipe_export_azure --config '<your_config>' azure_tenant