Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

Service Principal with a Secret Key and Azure API Integration

Azure Service Principals are an authentication mechanism for Azure instances. An Azure Service Principal is an identity created under Azure Active Directory to work with apps using role-based access controls. For example, when applications, hosted services, or automated tools need to access or modify resources, you can create a service principal and use it to authenticate.

Roles assigned to the service principal allow you to restrict access to resources, so you can control the resources and the level at which they are accessed. You should always use service principals with automated tools rather than allowing the tools to log in with a user identity.

IMPORTANT: Before you begin, contact Support to enable the Azure Service Principal for your tenant.

Configure an Application Registration in the Azure Portal

  1. Log in to the Azure portal using your Office 365 administrator account. Go to
  2. Go to Home > App registrations and click New registration.
  3. On Register an application page, configure the below properties:
    • Name. The display name for your application.
    • Supported Account Types. Select Accounts in their Organizational directory only.
    • Redirect URI. Select a platform and enter your Skyhigh CASB environment:  
      1. PROD:
      2. EUPROD:
      3. CAPROD:
  4. To create a new application, click Register.
  5. Confirm the new application's properties are configured correctly, as per step 3.
  6. Copy the Application (Client) ID and Tenant ID for future reference.
  7. Go to Certificates & secrets > Client secrets tab and click New client secret.
  8. Enter a description, an expiration date, and click Add.
  9. Copy the Secret Value for future reference.
  10. Select the existing subscriptions from the options to add new service principal to the existing subscriptions. This gives the service principal access to the resources within those subscriptions.
  11. Go to Subscription.
  12. Click Access Control (IAM) on the left side bar, then click the Role assignments tab.
  13. Click Add > Add role assignment.
  14. On the Add role assignment page, select the required role and click Next.

NOTE: The application must have the Reader and Storage Blob Data Reader roles to access the Azure resources.


  1. On the Members tab, click +select members to open the Select members pane. Select the member from the option and click Select
  2. Click Review + assign.

Follow the same steps for any other subscriptions you may have.

Create Azure Service Instance Using Service Principal in Skyhigh CASB

  1. In Skyhigh CASB go to Settings > Service Management
  2. Select your Azure instance or create a new one.  
  3. When you provide API credentials, enter the Client ID, Client Secret, and Tenant ID you saved from the previous steps. 
  • Was this article helpful?