Snow Discovery of Azure Active Directory. How can we do this?

Shaz_Berry asked a question.

December 2, 2021 at 3:44 AM

Hi Snowpeeps!

I would really like to know if anyone has worked out how to apply Discovery to Azure Active Directory.

There is the InTune Connector, however this pulls back Hardware and Software inventory as well.

I simply want a way to apply Discovery, without inventory. N.B our client uses Snow Agent on all computers.

My situation is that our client are provisioning computers using InTune, leaving records in AAD and not syncing back to Active Directory. Therefore this renders traditional Snow Discovery using LDAP useless.

Keen to hear what the community have found 🤙

Cheers

Shaz

@Sean Magner

Top Rated Answers

ThomasH
4 years ago
Hi Sharron,
we had to feed Discovered CIs from other sources to Snow in some scenarios, where no native Snow-method existed, as well. (e.g.: unsupported CMDB)
So we created/tested our own StoredProcedure '[SnowIntegration].[dbo].[DiscoveredCiAddUpdate]' to mimik the behavior/processing of the 'Snow Discovery data from file' connector of the SIM.
We then crafted some own (automated Process) which looked-up/listed CIs in the unsupported CMDB and handed them over to the SP.
The SP then checks, if the CI is already known to be inventoried in Snow, and if not creates the entries for a 'discovered' CI in snow InventoryDB then.

So, if you can automate the lookup in AAD by some means (e.g. using an MS-API), it should be relatively easy to use such an SP to create the discovered CIs in Snow then.

Of course, you can use the 'Snow Discovery data from file' connector of the SIM to get extracted/exported CIs from AAD into snow.
That's what I would to as a 'first step'.
Then - as a second step I would try to automate this process and if you need a more programatically/algorithmic way to control the process, have meaningfull logging and to avoid shuffling around export-/import files, I would then opt to use the SP.

In our case of 'unsupported CMDB' we opted for our own SP, as this was part of additional processing needed in creating our 'own' CMDB-Connctor using SQL-based jobs/SPs between those two DBs (Snow/CMDB) so now file ex-/import was necessary.
Naturally the SP is doing some checking and logging as well.

If you are interested in more details, please PM me and I will be happy to lend a helping hand.

Expand Post
Selected as Best

All Answers

Gert-Jan Kosterman
5 years ago
Hi Sharon,

did you configure and try the Microsoft Azure Connector? If you use this one the report "Cloud servers that are not inventoried" shows you the computers in the specified Azure tenant without discovery data? Is this what you are looking for?
The only minus is it will also show the VM's which MS uses e.g. to provide you an SQL database or other service you have running with them. So not only your own VM's. Another minus is the connector follows the same quarantine settings as for computers in you own estate. See my next idea too: Add a separate/dedicated set of Quarantine Settings for | Ideas Board (snowsoftware.com)

Kind regards,
Gert-Jan.
Expand Post
- Shaz_Berry
  5 years ago
  Thanks @Gert-Jan Kosterman. I have configured the Azure Connector, however it only shows Servers. I would like computer discovery. Snow tells me that the Azure Connector is for IaaS and will only show Servers.
  I will take a look at your Idea and vote up! Not sure about others, but I find it difficult to promote Ideas if you don't have a large following LOL.
  Expand Post
piideleteJune
5 years ago
Hi Sharon,
Interesting problem you have here. I've got one customer who is solely using Intune and AAD with no on premise AD to sync back to so almost the same situation. The Azure Discovery probably won't cover it as you say. I feel some tests coming on.
Expand Post
- Shaz_Berry
  5 years ago
  Thanks @Joseph Powell . Keen to hear how your tests go. Mine have proven fruitless unfortunately.
  
  Our Snow contact responded to my question/concern was "How about putting that up as in Idea". 😳 My response was:
  
  "One of the cool marketing points for Snow is “Discover your blind spots”. With more organisations moving to Azure AD, I think it weird that Snow doesn’t have a straight forward solution. Don’t you?"
  
  Tom responded with "We’ve had a look in the Ideas board and elsewhere, it looks like this has simply never been brought up before. Which is probably why the solution doesn’t exist."
  
  So, 1) I seriously hope (and doubt to be honest) that R&D is not reliant entirely on Ideas Board 😳 and 2) heck if it is....man there has got to be a better way to market Ideas! 🤣
  
  I will be placing an Idea on the Board and will let you know the Idea Number 🌺
  
  Enjoy your friday!
  Shaz
  
  Expand Post
  - piideleteJune
    5 years ago
    Ok so the sort answer is you'll never be able to query the Azure AD via LDAP so using an LDAP in Inventory is out.
    
    The best i think you are going to be able to do is, sadly as they say place an idea on the ideas board and have them modify the Intune connector to also be able to provide just the Azure AD registered devices - excluding the potential Azure AD joined devices.
    
    And yes we have our ideas on what the user community and the ITAM professionals need in a tool enhancement, Snow's internal ideas are more marketing driven. Sadly i don't think our paths cross 😥
    Expand Post
Shaz_Berry
4 years ago
Hi everyone following this string. The idea to provide a AAD connector is live. it only has 3 votes. Can everyone who can vote please! 🤗 https://ideas.snowsoftware.com/ideas/IDEAS-I-1875
Expand Post
ThomasH
4 years ago
Hi Sharron,
we had to feed Discovered CIs from other sources to Snow in some scenarios, where no native Snow-method existed, as well. (e.g.: unsupported CMDB)
So we created/tested our own StoredProcedure '[SnowIntegration].[dbo].[DiscoveredCiAddUpdate]' to mimik the behavior/processing of the 'Snow Discovery data from file' connector of the SIM.
We then crafted some own (automated Process) which looked-up/listed CIs in the unsupported CMDB and handed them over to the SP.
The SP then checks, if the CI is already known to be inventoried in Snow, and if not creates the entries for a 'discovered' CI in snow InventoryDB then.

So, if you can automate the lookup in AAD by some means (e.g. using an MS-API), it should be relatively easy to use such an SP to create the discovered CIs in Snow then.

Of course, you can use the 'Snow Discovery data from file' connector of the SIM to get extracted/exported CIs from AAD into snow.
That's what I would to as a 'first step'.
Then - as a second step I would try to automate this process and if you need a more programatically/algorithmic way to control the process, have meaningfull logging and to avoid shuffling around export-/import files, I would then opt to use the SP.

In our case of 'unsupported CMDB' we opted for our own SP, as this was part of additional processing needed in creating our 'own' CMDB-Connctor using SQL-based jobs/SPs between those two DBs (Snow/CMDB) so now file ex-/import was necessary.
Naturally the SP is doing some checking and logging as well.

If you are interested in more details, please PM me and I will be happy to lend a helping hand.

Expand Post
Selected as Best
Shaz_Berry
4 years ago
An Idea has been added to Snow Ideas: Idea IDEAS-I-1875 created.
Cheers all for your input. The community is strong 💪.
Shaz
Expand Post
Gert-Jan Kosterman
4 years ago
Hi Sharron,

could it be your idea has still the review by Snow status since it's not visible yet.

regards,
Gert-Jan.
Expand Post
- Shaz_Berry
  4 years ago
  It looks that way Gert-Jan. I guess I will just keep checking.
  Shaz
  Expand Post