Skip to main content

Cloud Labs: Bring Your Own Azure Account – Advanced

A secure, robust process for connecting your Azure account to Vocareum.

Written by Mary Gordanier

For Admins

To provision Azure resources in Cloud Labs, you will need to grant Vocareum permission to manage relevant aspects of your Azure account.

This article provides step-by-step instructions on how to give Vocareum the required access.

Choosing between the Basic and Advanced Guides

We generally recommend the process detailed in this advanced guide for connecting your Azure account to Vocareum for use in Cloud Labs. However, if you would like a quicker setup option, you can refer to the basic guide here: Cloud Labs: Bring Your Own Azure Account.

The Basic Guide offers a less complex setup suitable for straightforward integrations, while the Advanced Guide provides a more in-depth, customizable, and secure approach for organizations with advanced requirements.

Select the Basic Guide if:

  • You have an Azure subscription and seek a straightforward integration process.

  • Your organization does not require extensive customization or granular access controls.

  • You prefer a quicker setup with minimal configuration steps.

Opt for the Advanced Guide if:

  • You need to manage multiple Azure subscriptions under a unified structure.

  • Your organization requires detailed access controls, custom roles, and specific security configurations.

  • You aim to implement centralized policies and compliance measures across various departments or projects.

Setting up a Microsoft Entra ID app

  1. Sign in to the Azure Portal

  2. From the Azure services select 'Microsoft Entra ID'

  3. Select '+ Add' and then 'App Registration'

  4. Give the app a name (for example, Vocareum Cloud Labs). Under Supported account types, select Accounts in this organizational directory only (Single tenant). Leave Redirect URI blank — Vocareum signs in as the application itself using a client secret, so no redirect or user sign-in flow is used. Select Register.

  5. You will now be redirected to the Overview of the app you have just created

  6. Note down the 'Application (client) ID' and 'Tenant ID'. You will enter these in Vocareum. These credentials are required to pass with our authentication request for signing in programmatically.

  7. Next, create a client secret.

    1. Navigate to the App Registrations page in the Microsoft Entra admin center and select your App

    2. Next click on 'Certificates & secrets'

    3. Select 'Client secrets' and '+ New client secret'

    4. Include a description of the secret and set the duration. Select 'Add' when ready.

    5. The Value and Secret ID will now be displayed under the Client secrets. Copy the Value (not the Secret ID) — you will enter it in Vocareum as the client secret. Note the expiry date: when the secret expires, lab launches will fail until you create a new secret and update it in Control Center → Azure → Setup Tenant.

Management Groups

Management groups are containers that help you manage access, policy, and compliance across multiple subscriptions. Create these containers to build an effective and efficient hierarchy that can be used with Azure Policy and Azure Role Based Access Controls.

Create a Management Group

  1. Log in to the Azure Portal

  2. Navigate to Azure Service and Select 'more services'

  3. Under the categories select 'Management and governance' and then use the search filter to find 'Management groups'. Hovering over Management groups will display a '+' symbol. Select this symbol to create a group.

  4. Fill the required field. You can name your management group whatever you want. When ready select 'Save'

For Resource Group Level Labs

  1. You will have to create one management group inside the management group that you have created for your org. You can name this management group as per your choice.

  2. Move the subscriptions you want to use for labs into this management group. This ensures policies Vocareum applies at the organization level also apply to lab resources. Each subscription must also be registered in Vocareum (see Subscription Details).

For Subscription Level Labs

In a subscription-level lab, each student (or team) is given an entire Azure subscription for the duration of the lab. Vocareum does not create subscriptions — you provide a pool of subscriptions in advance, and Vocareum assigns a free one to each student at lab launch and returns it to the pool when the lab ends.

  1. Create a management group for subscription labs inside your organization's management group.

  2. Create the subscriptions you want to use as your pool (one per concurrent student or team), and move them into this management group.

  3. Register each subscription in Vocareum (see Subscription Details below).

Important:

  • The pool size is your concurrency limit. If every subscription is in use, additional students cannot launch a lab until one is released.

  • A newly registered or just-released subscription becomes available after about 2 days. Contact support if you need to test sooner.

  • When a lab ends, Vocareum deletes every resource group in the subscription. Only use subscriptions dedicated to Vocareum labs.

  • Subscription-level labs are configured as a separate tenant setup in Vocareum from resource-group labs. If you use both, you'll complete Setup Tenant once for each.

Assigning A Role to Your App in a Management Group

  1. Navigate to your organization's (root) management group, which also covers the lab management group inside it. Select Access Control from the left side menu

  2. Select '+ Add' and then 'Add Role Assignment'

  3. Under the Role tab, select the 'Owner' role. Vocareum needs Owner to create resource groups, assign the student role, and apply Azure Policies.

  4. Under the Members tab, assign access to 'User, group, or service principal'. Click '+ Select members' and select your app. If the app doesn't appear, search its name first

  5. Under the Conditions tab, select 'Allow user to assign all roles (highly privileged)'

  6. When ready select 'Review + Assign'

Configure the Student Role

Next, choose the Azure role students receive on their lab resource group (or subscription). You can use a built-in role or create a custom role.

Option A — built-in role (simplest): use Contributor (role ID b24988ac-6180-42a0-ab88-20f7382dd24c). Students can create and manage resources but cannot grant access to others.

Option B — custom role: create a custom role if you want to restrict students further.

  1. Go to your organization's management group → Access control (IAM) → + Add → Add custom role.

  2. On the Assignable scopes tab, make sure your organization's management group (or lab management group) is listed. If the role isn't assignable at the scope where your lab subscriptions live, students will not receive access.

  3. On the JSON tab, set the permissions. A recommended starting point:

    "permissions": [
      {
        "actions": ["*"],
        "notActions": [
          "Microsoft.Authorization/*/Write",
          "Microsoft.Authorization/*/Delete",
          "Microsoft.Authorization/elevateAccess/Action"
        ],
        "dataActions": [],
        "notDataActions": []
      }
    ]

    This lets students manage all resources in their lab while preventing them from creating role assignments, changing policies, or creating/removing locks. You can narrow actions further (for example, to specific resource providers) based on your course.

  4. Select Review + create.

  5. Find the role's ID: open the role under Access control (IAM) → Roles, select View → JSON, and copy the GUID at the end of the id value. You'll enter this in Vocareum under Role Config.

⚠️ Do not include Microsoft.Authorization/roleAssignments/write in the actions a student receives — it would allow students to grant themselves or others access to resources outside their lab.

API Permissions

For the app to access the resources API we will have to give it some API permissions

Allocate Permissions to an App

  1. From the Azure portal select Microsoft Entra ID.

  2. Navigate to and open 'Manage' and select 'App Registrations'

  3. Select your app and navigate to 'API Permissions'

  4. Click 'Add a Permission' and in the API Permission panel that opens select 'Microsoft Graph' under the 'Microsoft APIs' tab

  5. When prompted for the type of permissions your application requires, select 'Application Permissions'

  6. Add the following minimum required API permissions

    Required:

    • User.ReadWrite.All

    Required if using Temporary Access Pass sign-in (recommended — see Student sign-in with Temporary Access Pass):

    • UserAuthenticationMethod.ReadWrite.All

    Required if using Copilot Studio Labs:

    • Directory.ReadWrite.All

    • Group.ReadWrite.All

    • User.DeleteRestore.All

    • LicenseAssignment.ReadWrite.All

  7. Select 'Add Permissions' to complete the process. You should now see the selected permissions under 'Configured' permissions

  8. Click 'Grant admin consent' and confirm. The selected permissions should now all have the status of 'Granted'

API Permission Details

More information about the permissions granted to the Vocareum app can be found here

Student sign-in with Temporary Access Pass (recommended)

Microsoft requires multifactor authentication (MFA) to sign in to the Azure portal. Without additional configuration, every student lab account would need to register an authenticator app before starting a lab. To avoid this, Vocareum can issue each lab account a Temporary Access Pass (TAP) — a time-limited passcode that satisfies Microsoft's MFA requirement. Students are signed in automatically and never need to set up MFA.

Enable TAP in your tenant

  1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.

  2. Go to Entra ID → Authentication methods → Policies and select Temporary Access Pass.

  3. Select Enable, and under Include, target All users or a group containing your lab accounts.

    • Tip: To create a group targeting lab accounts, you can create a dynamic group on userPrincipalName starting with student_ (requires Entra ID P1).

  4. Select Configure and set:

    • Maximum lifetime — at least as long as your longest lab session (the default of 8 hours is too short for longer labs; the maximum is 30 days)

    • One-time use — No (Vocareum reuses the pass if a student reopens their lab)

  5. Select Save.

Grant the permission: make sure your app has the UserAuthenticationMethod.ReadWrite.All application permission with admin consent (see API Permissions).

Turn it on in Vocareum: contact Vocareum support to enable Temporary Access Pass for your organization or specific courses.

Tip: if your tenant uses security defaults or an authentication-methods registration campaign, students may still be prompted to "set up more information." Exclude your lab accounts from the registration campaign to avoid this.

Connecting your tenant in Vocareum

Before you begin, contact Vocareum support to enable Azure Labs for your organization. You'll need org admin access in Vocareum.

Set up the Tenant

  1. From your Vocareum Home page, open Control Center, select Azure in the side menu, then Dashboard.

  2. Select Setup Tenant, then + Setup Tenant, and fill in:

    • Customer key — any identifier for this setup, no spaces (e.g., MyOrg-RG-Labs)

    • Username / Password — not used; enter -

    • Tenant ID — from your app's Overview page

    • Domain — a verified domain in your tenant (e.g., myorg.onmicrosoft.com). Student lab accounts are created in this domain.

    • Client ID — the app's Application (client) ID

    • Secret ID — the client secret Value (not the Secret ID)

    • Subscription type — select this only for subscription-level labs. Resource-group and subscription labs each need their own tenant setup.

    • Root management group — the ID (not display name) of your organization's management group

    • Lab management group — the ID of the lab management group you created inside it

Register Subscriptions

Select Subscription Details → + Add Subscription for each subscription:

  • Subscription name / ID — from the Azure portal

  • Is Generic Subscription — Yes for standard resource-group labs

  • Is Active — this means currently assigned to a student. Set to No for subscription-level lab pools.

Add the Student Role (Role Config)

Select Role Config → + Add Role Config and fill in:

  • Azure Role Type — a label for your reference (e.g., Contributor)

  • Azure Role Id — the role GUID from the Configure the Student Role section

  • Is generic lab role — Yes

  • Is Active — Yes

Let Vocareum know you're done

Contact Vocareum support to confirm setup. We'll verify your organization is linked to your tenant before your first lab launch.

Did this answer your question?