Create an AzureHound Configuration

Prerequisites

To complete the configuration process, you must have the following information:

Item	Description
Directory (tenant) ID	Identifies the Microsoft Entra ID instance where you must register the AzureHound Enterprise application.
Application (client) ID	Identifies the AzureHound Enterprise app registration that you must create in the Microsoft Entra admin center.
AzureHound token ID	Identifies the AzureHound Enterprise collector client that you must create in BloodHound Enterprise.
AzureHound token	Provides the authentication key for the AzureHound Enterprise collector client that you must create in BloodHound Enterprise.
BloodHound Enterprise URL	The URL of your BloodHound Enterprise tenant (for example, `https://<your-tenant>.bloodhoundenterprise.io/`).
Managed Identity Client ID	If using Azure Managed Identity authentication, identifies the managed identity that the AzureHound Enterprise app registration trusts and that is assigned to the Azure resource where you run AzureHound Enterprise.
Certificate and private key	If using Certificate authentication, the certificate and private key used to authenticate the AzureHound Enterprise application. The AzureHound Enterprise CLI tool can generate this for you during the configuration process if needed.

Configuring AzureHound Enterprise involves the following steps: Follow the steps below to create your AzureHound Enterprise configuration file using the AzureHound Enterprise CLI tool.

Download AzureHound Enterprise

Login to your BloodHound Enterprise tenant.
In the left menu, click Download Collectors.
Download the AzureHound Enterprise ZIP archive.
Choose the option suitable for your system’s architecture (ARM64 or AMD64).
Extract the contents of the ZIP archive to a working directory on the system where you plan to run the AzureHound Enterprise binary.

Configure connection to Azure

Start the AzureHound Enterprise CLI tool with the configure command.
```
C:\Users\Administrator.ROOT\Downloads\azurehound-v2.8.2\azurehound-windows-amd64>azurehound.exe configure
```
To see all available options, run azurehound.exe -h.

Select the Azure region where your organization’s tenant is hosted.

Most organizations use the cloud region.

AzureHound v2.8.2
Created by the BloodHound Enterprise team - https://bloodhoundenterprise.io

Use the arrow keys to navigate: ↓ ↑ ← →
? Azure Region:
  china
> cloud
  usgov14
  usgov15

Enter the Azure Directory (tenant) ID.

Directory (tenant) ID: b82887fc-338d-44ab-97d6-ac32d060ad7e

Enter the Azure Application (client) ID that you created when registering the AzureHound Enterprise application.
```
Application (client) ID: 18a7b927-9905-484e-8b17-c09630ce8ff2
```

Configure AzureHound authentication

Choose one of the following authentication methods for AzureHound Enterprise to connect to your Microsoft Entra ID and Azure environment:

Azure Managed Identity
Certificate

Microsoft recommends user-assigned managed identities for Microsoft services, so this example uses the user-assigned type. AzureHound Enterprise also supports system-assigned managed identities, but that workflow is not covered in this guide.Before configuring Azure Managed Identity authentication, you must first create a user-assigned managed identity, assign it to the Azure resource where you plan to run AzureHound Enterprise, and configure the AzureHound Enterprise app registration to trust that identity.

Select Azure Managed Identity as the authentication method.

Use the arrow keys to navigate: ↓ ↑ ← →
? Authentication Method:
    Certificate
    Client Secret
    Username and Password
  > Azure Managed Identity

Select User-Assigned as the Managed Identity type.

Use the arrow keys to navigate: ↓ ↑ ← →
? Managed Identity Type:
    System-Assigned
  > User-Assigned

Enter the Client ID of the User-Assigned Managed Identity.
```
v Input the User-Assigned Managed Identity (Client ID):
```
To find the Client ID, navigate to the Managed Identity in the Azure portal and copy the value from the Client ID field in the Overview.
Press Enter (or enter Y) to connect to BloodHound Enterprise.
```
? Setup connection to BloodHound Enterprise? [Y/n]
```

Enter the URL of your BloodHound Enterprise tenant.

v BloodHound Enterprise URL: https://<your-tenant>.bloodhoundenterprise.io/

Select Certificate as the authentication method.

Use the arrow keys to navigate: ↓ ↑ ← →
? Authentication Method:
  > Certificate
    Client Secret
    Username and Password
    Azure Managed Identity

Press Enter or type Y to create a new certificate and key.
```
Authentication Method: Certificate
? Generate Certificate and Key? [Y/n]
```
- The certificate generated by AzureHound expires after one year.
- If using a certificate issued by another authority, AzureHound Enterprise supports certificates with the following characteristics:
  - PEM encoded
  - RSA 256
  - PKCS#8 or PKCS#5

Enter an optional passphrase for the private key.

Authentication Method: Certificate
v Private Key Passphrase (optional):

Press Enter (or enter Y) to connect to BloodHound Enterprise.
```
? Setup connection to BloodHound Enterprise? [Y/n]
```

Enter the URL of your BloodHound Enterprise tenant.

v BloodHound Enterprise URL: https://<your-tenant>.bloodhoundenterprise.io/

Configure AzureHound collector client

Create an AzureHound collector client. Continue to the next step when you have the Token ID and Token.

Enter the collector client’s Token ID.

v BloodHound Enterprise Token ID: bb7b957f-2508-400b-971e-6a1857cc0101

Enter the collector client’s Token.

v BloodHound Enterprise Token: ****************************************

(Optional) Enter y if you want to use a proxy URL.
Most organizations do not use a proxy.
```
? Set proxy URL? [y/N]
```

Configure AzureHound logging

Press Enter (or type y) to set up local logging.
```
? Setup AzureHound logging? [Y/n]
```

Select the logging verbosity, as a start we recommend Default.

Use the arrow keys to navigate: ↓ ↑ ← →
? Verbosity:
    Disabled      
  > Default
    Debug
    Trace

Enter a name for the log file.
You can also enter a full path as a file name. If you do not specify a full path, AzureHound Enterprise writes logs to the specified file name and stores it in the same directory as the AzureHound binary.
```
v Log file (optional): azurehound.log
```
If you want AzureHound Enterprise to generate JSON-structured logs, press Enter or type y.
```
? Enable Structured Logs? [y/N]
```

Review configuration summary

When configuration is complete, the AzureHound Enterprise CLI tool displays a configuration summary.

Configuration written to C:\Users\Administrator.ROOT\.config\azurehound\config.json
Key written to C:\Users\Administrator.ROOT\.config\azurehound\key.pem
Certificate written to C:\Users\Administrator.ROOT\.config\azurehound\cert.pem

Ensure certificate is uploaded to your application's client credentials

The example above shows the summary for Certificate authentication. For Azure Managed Identity authentication, the summary omits the key and certificate paths and the certificate upload reminder.

​Prerequisites

Prerequisites