> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudgeni.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Setup

> Use Azure Quick Connect, verify the integration becomes active, and then use Azure-backed cloud monitoring or compliance views.

# Azure Setup

Azure should be connected through **Quick Connect** in the current product.

As of **March 11, 2026**, the manual credential path is a legacy fallback and is explicitly marked
deprecated after **October 1, 2025** in the app code.

## In The UI

1. Go to `Settings` -> `Integrations` -> `Cloud`
2. Choose **Connect Azure**
3. Stay on the Quick Connect path
4. Complete the Azure redirect and callback flow
5. Return to the cloud integrations list and verify the integration becomes active

## Guest Users (B2B) In Another Directory

If your subscriptions live in a Microsoft Entra directory where you are a **guest user**, the
default sign-in lands in your home directory and the connection fails with "No Azure subscriptions
found". Use the optional **Microsoft Entra directory (tenant)** field on the Quick Connect card to
enter the tenant ID or a verified domain of the directory that holds your subscriptions. You still
need Owner (or User Access Administrator) on the target subscription in that directory so Quick
Connect can create the role assignments.

## After Connect

Once the integration is active:

* Run a sync to confirm inventory access
* Use [Cloud Monitors](/features/cloud-monitors) for Azure Defender findings
* Use [Cloud Compliance](/features/cloud-compliance) for framework-based posture scans
* Use Cost & Billing views after Azure Cost Management data has been collected

## If You Need A Manual Privilege Reference

Quick Connect creates the required read-only role assignments automatically. The manual privilege
reference is a subscription-scoped service principal with `Reader`, `Cost Management Reader`,
`Security Reader`, `Log Analytics Reader`, and `Storage Account Key Operator Service Role`.
`Cost Management Reader` is required for actual Cost & Billing data.

```bash theme={null}
export SCOPE="/subscriptions/$AZURE_SUBSCRIPTION_ID"

SP_JSON=$(az ad sp create-for-rbac \
  --name cloudgeni-reader \
  --role Reader \
  --scopes "$SCOPE" \
  --output json)

# Requires jq (https://jqlang.org/download/) in addition to az CLI.
APP_ID=$(echo "$SP_JSON" | jq -r .appId)
CLIENT_SECRET=$(echo "$SP_JSON" | jq -r .password)
TENANT_ID=$(echo "$SP_JSON" | jq -r .tenant)

SP_OBJECT_ID=$(az ad sp show --id "$APP_ID" --query id --output tsv)

for ROLE in \
  "Cost Management Reader" \
  "Security Reader" \
  "Log Analytics Reader" \
  "Storage Account Key Operator Service Role"
do
  az role assignment create \
    --assignee-object-id "$SP_OBJECT_ID" \
    --assignee-principal-type ServicePrincipal \
    --role "$ROLE" \
    --scope "$SCOPE"
done
```

Capture the full `create-for-rbac` output before extracting fields: the client secret (`password`)
is returned exactly once and cannot be retrieved later. The manual credential form needs `APP_ID`
(client ID), `CLIENT_SECRET`, and `TENANT_ID`.

Treat that as a reference, not as the preferred onboarding path.

## Next

<CardGroup cols={2}>
  <Card title="Connect Cloud" icon="cloud" href="/getting-started/connect-cloud-accounts">
    Return to the shared cloud setup page.
  </Card>

  <Card title="Cloud Compliance" icon="clipboard-check" href="/features/cloud-compliance">
    Move into framework-based posture review once setup is healthy.
  </Card>
</CardGroup>