According to the official Microsoft SC-300 Study Guide and Microsoft Entra Permissions Management documentation , onboarding Microsoft Entra Permissions Management (formerly CloudKnox) involves two key setup tasks:
* Configuring Data Collection - After purchasing the license, you must connect your Azure subscription (s) to Permissions Management so it can inventory identities, roles, and permissions. This is done from the Microsoft Entra Permissions Management portal, where you enable data collection for each connected cloud environment (Azure, AWS, GCP). This process deploys the required collector identity (service principal) and defines the scope for data gathering.
* Creating Role Assignments - Permissions Management requires proper authorization to read role assignments, permissions, and activity data. You must create a role assignment at the subscription level (Sub1) using a least-privilege role (for example, Reader or CloudKnox Service Principal Role ) for the Permissions Management application service principal. This ensures it can scan Azure resources for permission analysis.
Microsoft documentation confirms:
"To onboard Azure subscriptions, assign the CloudKnox service principal a Reader role on each subscription, and configure data collection from within Microsoft Entra Permissions Management."