> Source: [sk173403](https://support.checkpoint.com/results/sk/sk173403)

# sk173403 - "Missing Permissions for CloudGuard-Connect [Show More]" error displayed in CloudGuard (Dome9) for Azure subscriptions

| Property | Value |
|----------|-------|
| Solution ID | sk173403 |
| Date Created | 2021-05-05 |
| Last Modified | 2021-05-17 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |

## Symptoms

- * CloudGuard Environment detailed view page for Azure Subscriptions that contain one or more Key Vaults displays a "Missing Permissions for CloudGuard-Connect \[Show More\]" warning banner.
* When the user clicks "Show More", it reveals a list of one or more cloud resource entity-models, each paired with one or more required API commands that the service is unable to execute without triggering "permission denied" errors.

## Cause

* Access to Azure Key Vault metadata cannot be granted by a Role-based permission mechanism.
* Key Vault permissions must be granted on an individual Key Vault basis.
* Vault Policy-based Azure Graph API permissions that are required to collect metadata on Key Vault-stored Keys, Secrets, and Certificates are not compatible with the use of Key Vault-specific Firewall Rules.

## Solution

You have to complete additional permission delegation steps, with Key Vault "Vault Policy", to allow the CloudGuard service to issue certain *read-only* commands to the Azure Graph API.

Prerequisites
-------------

1. Complete all onboarding steps for Azure subscriptions and for Azure Key Vault Entities as appear under [Onboard an Azure Subscription](https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Default.htm#cshid=103) and [Configure Policies for Azure Key Vault Entities](https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Default.htm#cshid=3).

2. Configure the Azure Key Vault to allow **Vault Policy**-based access to Azure Graph API ("get" and "list") permissions. Do not use Key Vault Firewall Rules to avoid perpetual Key Vault permission warnings in the relevant Azure Subscription Detailed View in the CloudGuard Native portal.

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk173403/sk173403-1-lg202105172103451.png)

   <br />

**![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk173403/sk173403-2-lg202105172108503.png)
Follow the steps below to enable CloudGuard Native to collect Azure \> Key Vault \> Keys, Secrets, Certificates metadata.**

**Note:**This solution does not expose any private details related to the user stored Keys, Secrets, or Certificates.

Configuring Azure
-----------------

1. Navigate to **Azure \> Key Vault \> Access Policies** and verify that your Key Vault Permission Model is **Vault access policy**.

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk173403/sk173403-3-lg202105172109534.png)
2. Select **Add Access Policy**and fill in the options below:

   * In **Configure from Template** , select **Key, Secret, and Certificate Management**
   * In **Key Permissions** , select **List** and **Get** (if necessary, deselect everything else)
   * In **Secret Permissions** , select **List** and **Get**(if necessary, deselect everything else)
   * In **Certificate Permissions** , select **List** and **Get**(if necessary, deselect everything else)
   * In **Select Principal** , search using the **CloudGuard-Connect** (Enterprise Application) **Object ID**
   * In **Authorized Application** , search using the **CloudGuard-Connect** (Enterprise Application) **Object ID**

   **Note** : Use the **Object ID** value from your **CloudGuard-Connect** Enterprise Application:
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk173403/sk173403-4-lg202105172112091.png)
3. Click **Save.**

   The resulting Key Vault Access Policy should look like this:
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk173403/sk173403-5-lg202105172112592.png)

Configuring CloudGuard Native
-----------------------------

1. Go back to the **CloudGuard Portal** \> **Assets** \> **Environments** , navigate to the relevant Azure subscription detailed view and click **VALIDATE PERMISSIONS**.

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk173403/sk173403-6-lg202105172113443.png)  

2. CloudGuard Native resumes attempts to collect data using the **ListKeys** and other commands.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content