Skip to main content

Write Permissions Security: Secrets, RBAC, Audits

Principle of Least Privilege​

Only enable the write permissions you need. Each one grants more access, so:

  • Use a separate write credential for production. The Configuration page compares same and separate credentials.
  • Use the custom role Spotto generates rather than a broad built-in role.
  • Review enabled permissions regularly and turn off any you no longer use.

Monitor Access​

Azure's Activity Log records every action a service principal takes:

  1. Go to Subscriptions > Activity Log in the Azure Portal.
  2. Filter by Caller and select your Spotto write app.
  3. Review the actions Spotto took.

Use it to confirm Spotto only performs expected actions, spot unusual activity, and keep an audit trail of automated changes.

Rotate Credentials​

Set an expiry on client secrets (recommended: 12 months) and update Spotto before they expire:

  1. Create a new client secret in Azure for the app.
  2. Update the credential in the Spotto Portal.
  3. Select Validate Connection to confirm the new secret works.
  4. Delete the old client secret in Azure.

Revoke Access​

Option 1: Turn off write access in Spotto​

  1. Go to Connectors -> Cloud Accounts in the Spotto Portal.
  2. Edit your cloud account.
  3. Turn off Enable write access.
  4. Select Update.

This is the quickest way to stop write-back. Spotto removes the stored write client ID, secret and expiry date, so you need to enter them again to turn it back on.

Option 2: Remove the Azure roles​

  1. Go to your Azure subscription > Access Control (IAM).
  2. Find your Spotto write app.
  3. Remove its role assignments.

Write actions fail while the app and its secret stay in place for later use.

Option 3: Delete the app​

Go to Entra ID > App registrations, find your Spotto write app and select Delete. This permanently removes the service principal and its credentials.

Regular Security Reviews​

  • Monthly: check Activity Logs for unusual patterns.
  • Quarterly: review enabled permissions and turn off any you no longer need.
  • Annually: rotate client secrets and review the app registrations.

Additional Recommendations​

  1. Require MFA for users who can manage service principals.
  2. Use Azure Policy to enforce your organization's security standards.
  3. Document which permissions are enabled and why.
  4. Test in a development environment before enabling write permissions in production.
  5. Set up Azure Monitor alerts for critical actions.

For setup problems, see Troubleshooting. For further assistance, please Contact Us.