## Set up Microsoft Azure Event Hubs

URL: https://docs.atlan.com/apps/connectors/messaging/microsoft-azure-event-hubs/how-tos/set-up-microsoft-azure-event-hubs

> Atlan supports the following authentication methods for Microsoft Azure Event Hubs:.

Atlan supports the following authentication methods for Microsoft Azure Event Hubs:

- [SAS key](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt) - this method uses a connection string-primary key to fetch metadata.
- [Service principal](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt) - in addition to a connection string-primary key, this method requires a client ID, client secret, and tenant ID to fetch metadata.

## SAS key authentication

:::warning Who can do this?
 You will need your Microsoft Azure Event Hubs administrator to complete these steps - you may not have access yourself.

:::

### Create a shared access signature policy

You will need to create a shared access signature (SAS) policy in Microsoft Azure Event Hubs for authentication in Atlan.

The [_Manage_ permission](https://learn.microsoft.com/en-us/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies) is required for the following:

- Atlan requires read permissions of the configurations set to event hubs and the event hub namespace. Since Atlan currently only supports SAS policy-based authentication, _Manage_ permission is required to provide this type of access. SAS policies do not support granular access control while _Send_ or _Listen_ permission is insufficient to crawl configuration metadata. Granular permissions will only be available once Atlan supports other authentication methods that allow for the granular access control capabilities of Microsoft Azure.
- To fetch the [Azure Event Hub status attribute](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/what-does-atlan-crawl-from-microsoft-azure-event-hubs/llms.txt) and [Azure Event Hub consumer group assets](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/what-does-atlan-crawl-from-microsoft-azure-event-hubs/llms.txt) through the Azure APIs.

To [create a SAS policy](https://learn.microsoft.com/en-us/azure/event-hubs/authorize-access-shared-access-signature) for [crawling Microsoft Azure Event Hubs](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/crawl-microsoft-azure-event-hubs/llms.txt):

1. Log in to the [Azure portal](https://portal.azure.com).
2. Open the menu and search for or click **Event Hubs**.
3. On the _Event Hubs_ page, click the namespace of your event hub. Copy your _Event Hubs Namespace_ to use for [authentication in Atlan](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/crawl-microsoft-azure-event-hubs/llms.txt).
4. In the left menu of your event hub namespace, under _Settings_, click **Shared access policies**.
5. On the _Shared access policie_s page, click **\+ Add** to add a new SAS policy.
6. In the _Add SAS policy_ sidebar, enter the following details:
 1. For _Policy name_, enter a meaningful name - for example, `Atlan integration policy`.
 2. To add the [_Manage_ permission](https://learn.microsoft.com/en-us/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies) to your SAS policy, click **Manage**.
 3. Click **Create** to finish setup.
7. On the _Shared access policie_s page, select the newly created SAS policy.
8. From the corresponding _SAS Policy_ dialog, under _Connection string-primary key_, click the clipboard icon to copy the connection string-primary key and store it in a secure location.

You will need your event hub namespace and the connection string-primary key for [crawling Microsoft Azure Event Hubs](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/crawl-microsoft-azure-event-hubs/llms.txt).

## Service principal authentication

:::warning Who can do this?
 You will need your Microsoft Azure Event Hubs administrator to [create a shared access signature policy](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt) and _[Cloud Application Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#cloud-application-administrator)_ or _[Application Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#application-administrator)_ to [register an app with Microsoft Entra ID](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt) and [add it to the Event Hubs Data Sender role](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt) - you may not have access yourself.

:::

You need the following to authenticate the connection in Atlan:

- [Connection string-primary key](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt) - required to crawl Kafka assets
- [Client ID](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt) (application ID), [client secret](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt), and [tenant ID](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt) (directory ID) - required to crawl Microsoft Azure Event Hubs assets 

### Create a shared access signature policy

Follow the steps in [Create a shared access signature policy](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt) to generate a connection string-primary key for [crawling Microsoft Azure Event Hubs](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/crawl-microsoft-azure-event-hubs/llms.txt).

### Register app with Microsoft Entra ID

You will need to register your service principal application with Microsoft Entra ID and note down the values of the tenant ID, client ID, and client secret.

To register your app with Microsoft Entra ID:

1. Log in to the [Azure portal](https://portal.azure.com/).
2. In the search bar, search for **Microsoft Entra ID** and select it from the dropdown list.
3. From the left menu of the _Microsoft Entra ID_ page, click **App registrations**.
4. From the toolbar on the _App registrations_ page, click **\+ New registration**.
5. On the _Register an application_ page, for _Name_, enter a name for your service principal application and then click **Register**.
6. On the homepage of your newly created application, from the _Overview_ screen, copy the values for the following fields and store them in a secure location:
 - **Application (client) ID**
 - **Directory (tenant) ID**
7. From the left menu of your newly created application page, click **Certificates & secrets**.
8. On the _Certificates & secrets_ page, under _Client secrets_, click **\+ New client secret**.
9. In the _Add a client secret_ screen, enter the following details:
 1. For _Description_, enter a description for your client secret.
 2. For _Expiry_, select when the client secret will expire.
 3. Click **Add**.
10. On the _Certificates & secrets_ page, under _Client secrets_, for the newly created client secret, click the clipboard icon to copy the _Value_ and store it in a secure location.

### Add app to Event Hubs Data Sender role

You will need to add the [service principal application](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt) created in the previous step to the [Azure Event Hubs Data Sender role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#azure-event-hubs-data-sender).

To add a service principal to the Azure Event Hubs Data Sender role:

1. Log in to the [Azure portal](https://portal.azure.com).
2. Open the menu and search for or click **Event Hubs**.
3. On the _Event Hubs_ page, click the namespace of your event hub.
4. From the left menu of your event hubs namespace page, click **Access Control (IAM)**.
5. In the upper right of the _Access Control (IAM)_ page, navigate to the _Add a role assignment_ tile and then click **Add**.
6. On the _Add a role assignment_ page, enter the following details:
 1. For _Role_, click the dropdown to select **Azure Event Hubs Data Sender** - this allows [send access to Azure Event Hubs resources](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#azure-event-hubs-data-sender).
 2. For _Assign access to_, click the dropdown to select **Azure AD user, group, or service principal**.
 3. For _Select_, choose the [service principal application you created](https://docs.atlan.com/llms/connectors/microsoft-azure-event-hubs/set-up-microsoft-azure-event-hubs/llms.txt) in the previous step.
 4. Click **Save** to save your role assignment.

---