Azure Setup

Azure should be connected through Quick Connect in the current product. As of March 11, 2026, the manual credential path is a legacy fallback and is explicitly marked deprecated after October 1, 2025 in the app code.

In The UI

Go to Settings -> Integrations -> Cloud
Choose Connect Azure
Stay on the Quick Connect path
Complete the Azure redirect and callback flow
Return to the cloud integrations list and verify the integration becomes active

Guest Users (B2B) In Another Directory

If your subscriptions live in a Microsoft Entra directory where you are a guest user, the default sign-in lands in your home directory and the connection fails with “No Azure subscriptions found”. Use the optional Microsoft Entra directory (tenant) field on the Quick Connect card to enter the tenant ID or a verified domain of the directory that holds your subscriptions. You still need Owner (or User Access Administrator) on the target subscription in that directory so Quick Connect can create the role assignments.

After Connect

Once the integration is active:

Run a sync to confirm inventory access
Use Cloud Monitors for Azure Defender findings
Use Cloud Compliance for framework-based posture scans
Use Cost & Billing views after Azure Cost Management data has been collected

If You Need A Manual Privilege Reference

Quick Connect creates the required read-only role assignments automatically. The manual privilege reference is a subscription-scoped service principal with Reader, Cost Management Reader, Security Reader, Log Analytics Reader, and Storage Account Key Operator Service Role. Cost Management Reader is required for actual Cost & Billing data.

export SCOPE="/subscriptions/$AZURE_SUBSCRIPTION_ID"

SP_JSON=$(az ad sp create-for-rbac \
  --name cloudgeni-reader \
  --role Reader \
  --scopes "$SCOPE" \
  --output json)

# Requires jq (https://jqlang.org/download/) in addition to az CLI.
APP_ID=$(echo "$SP_JSON" | jq -r .appId)
CLIENT_SECRET=$(echo "$SP_JSON" | jq -r .password)
TENANT_ID=$(echo "$SP_JSON" | jq -r .tenant)

SP_OBJECT_ID=$(az ad sp show --id "$APP_ID" --query id --output tsv)

for ROLE in \
  "Cost Management Reader" \
  "Security Reader" \
  "Log Analytics Reader" \
  "Storage Account Key Operator Service Role"
do
  az role assignment create \
    --assignee-object-id "$SP_OBJECT_ID" \
    --assignee-principal-type ServicePrincipal \
    --role "$ROLE" \
    --scope "$SCOPE"
done

Capture the full create-for-rbac output before extracting fields: the client secret (password) is returned exactly once and cannot be retrieved later. The manual credential form needs APP_ID (client ID), CLIENT_SECRET, and TENANT_ID. Treat that as a reference, not as the preferred onboarding path.

Connect Cloud

Return to the shared cloud setup page.

Cloud Compliance

Move into framework-based posture review once setup is healthy.

Getting Started

Trust

Features

Integrations

CLI

Compliance

Troubleshooting

Support

Azure Setup

Azure Setup

In The UI

Guest Users (B2B) In Another Directory

After Connect

If You Need A Manual Privilege Reference

Next

Connect Cloud

Cloud Compliance

​Azure Setup

​In The UI

​Guest Users (B2B) In Another Directory

​After Connect

​If You Need A Manual Privilege Reference

​Next

Connect Cloud

Cloud Compliance

Azure Setup

In The UI

Guest Users (B2B) In Another Directory

After Connect

If You Need A Manual Privilege Reference

Next