NewOrbit Access Report Setup (via Cloud Management Platform – BETA)

NewOrbit’s Cloud Management Platform (CMP) enables centralised auditing of user access across your Azure environment. It provides a consolidated view of who has access to what, supporting security and compliance.

Important: the CMP does not provide NewOrbit with access to any of your application data or system content. It only enables visibility of Azure infrastructure metadata related to access and permissions.

Set-Up Overview

To enable access logging and reporting, a small number of one-time configuration steps are required within your Azure environment.

Permissions Required

The initial setup requires:

• Ability to add Enterprise Applications in Azure Active Directory (Global Administrator is recommended for simplicity)
• User Access Administrator permissions (or higher) on each Azure subscription you want included

These steps can be completed by different individuals if needed.

Step-by-Step Setup

1. Access the Platform

• Go to NewOrbit CMP
• Log in using your Azure credentials

2. Grant SSO Consent

• You will be prompted to approve Single Sign-On (SSO) access
• You can consent for:
  • Yourself only, or
  • Your entire organisation

3. Complete Required Permissions

• Once logged in, you will see a notification: "1 consent is missing"
• Select this and approve access to:
  • Read user directory data (names only)

This is required for the Access Report to correctly map permissions to users.

4. Grant Azure Reader Access

To allow access auditing, the CMP requires read-only visibility of your Azure resources metadata.

For each subscription:

• Go to the Azure Portal
• Select the relevant Subscription
• Select "Access control (IAM)"
• Click "Add" → "Add role assignment"
• Select the Reader role
• Click "Next"
• Click "Select Members" and search for:
  • NewOrbit-CMP
• Select it and proceed to Review + Assign

Optional: Use Management Groups

If you manage multiple subscriptions:

• Go to Management Groups in Azure
• Use (or initialise) the Tenant Root Group
• Assign the Reader role to NewOrbit-CMP at this level

This avoids needing to repeat the process per subscription.

Security

When your users log in to the Cloud Management Platform, we use their access token to read data from Azure. This means they can never see any more data than they would be able to in the Azure portal. If they can’t see costs in the Azure portal, for example, they will not be able to see costs in the Cloud Management Platform.

For NewOrbit, it works a bit differently. In the steps above, we ask you to give the Enterprise Application “NewOrbit-CMP” the reader role in each of your Azure subscriptions. When a NewOrbit user accesses the CMP, they use the permissions from the NewOrbit-CMP Enterprise Application to read data about your Azure subscription. The reader role gives access to Azure information, such as which resources you have and costs. However, the reader role does not give access to data in databases or to configuration values or anything else that may contain secrets. You retain full control and can customise or revoke the access the NewOrbit-CMP Enterprise Application has to your Azure subscription at any time. If you want to completely block NewOrbit from access, just delete that Enterprise Application from your Azure AD.

Additional Feature

Cost Report

Alongside access reporting, the CMP also includes a Cost Report view providing a high-level summary of Azure spend for the previous full calendar month, helping identify the top 3 Service and Resource expenses. It uses the approach set out in our Spend less on Azure approach to help you - and us - identify the areas that you are spending most on in Azure.