Skip to main content

Microsoft Azure Setup Guide

Use this guide to connect Microsoft Azure to Cloudaware by creating an app registration, granting the required API permissions and RBAC roles, validating the connection, and optionally enabling subscription discovery.

Before You Begin​

Make sure that:

  • You have access to Admin Console in Cloudaware.
  • You have permission in Azure to create App registrations, grant admin consent, and assign RBAC roles.
  • You know which Azure environment you need to use.
  • You know whether you want Cloudaware to monitor:
    • the whole tenant through the Tenant Root Group
    • selected subscriptions only
  • You are ready to use one of these authentication methods:
    • Certificate (recommended)
    • Client secret
note

If you are new to Cloudaware and don’t have the account yet, use the Get Started guide to add cloud accounts.

High-level Setup Flow​

To integrate Microsoft Azure with Cloudaware:

  1. Create a new Azure application for Cloudaware.
  2. Assign API permissions to the application:
    • Azure Service Management
      • Delegated permissions: user_impersonation
    • Microsoft Graph
      • Application permissions: Directory.Read.All
      • Delegated permissions: Directory.Read.All
  3. Add role assignments based on the required scope:
    • Tenant Root Group — for subscription auto-discovery
    • Specific subscription — for selected subscription monitoring
  4. Choose the authentication method:
    • Certificate (recommended): Download the certificate from Cloudaware and upload it to the Azure application.
    • Client Secret: Create a secret in Azure and add it to Cloudaware when onboarding.
  5. Add the Azure Active Directory to Cloudaware, using the application details.
  6. Validate credentials.
  7. Save the configuration.

Register the Azure Application​

  1. Sign in to the Azure portal.
  2. Go to App registrations. Click + New registration.
  3. Enter the required settings:
    • Name: Enter a descriptive name, for example, cloudaware-api-access.
    • Supported account types: Select Single tenant only — Default Directory (Accounts in this organizational directory only) or Multiple Entra ID tenants (Accounts in any organizational directory)(in this case, specify allowed tenant IDs manually).
    • Redirect URI: (optional) Select Web and enter https://cloudaware.com.
  4. Click Register.
  5. Copy and save the following values:
    • Application (client) ID
    • Directory (tenant) ID

You will use these values later in Cloudaware.

Configure API Permissions​

  1. Open the application created for Cloudaware.

  2. Under Manage on the left, go to API permissions. Click Add a permission.

  3. Under Microsoft APIs, select Azure Service Management:

    • Select Delegated permissions
    • Enable user_impersonation

  4. Select Microsoft Graph and add the following permissions:

    • Delegated: Directory → Directory.Read.All
    • Application: Directory → Directory.Read.All
    tip

    If your setup requires Azure Active Directory users and devices only, add the granular least-privilege permissions described in Least-Privilege Policies (Directory & Graph permissions section).

    If your setup requires Intune device inventory, add the Intune permissions described in Least-Privilege Policies (Intune section).

  5. Grant admin consent for the directory.

note

Permissions may take up to 30 minutes to propagate.

Assign RBAC Roles​

Decide whether Cloudaware should discover resources across the entire tenant or only in selected subscriptions. Use one of the options below:

Tenant-Wide Discovery​

Use this option to let Cloudaware discover resources broadly across the tenant.

Grant access at the Tenant Root Group:

  1. In Azure, go to Management groups.

  2. Select the tenant root group.

    Can't see or select management groups?

    It means you don't have permission to access this level. Workaround:

    • From the Azure portal home page, search for and select Microsoft Entra ID.
    • Select the Properties tab. Under Access management for Azure resources, set the toggle to Yes.
    • Log out of the Azure portal and log in.
    • In the left pane under Manage, select the Access Control (IAM) tab. Assign the Reader role to Tenant Root Group.
    • Go back to Microsoft Entra ID → the Properties tab. Under Access management for Azure resources, set the toggle to No.

    Refer to the Microsoft documentation to learn more.

  3. In the left pane under Manage, select the Access control (IAM) tab.

  4. Click + Add, then Add role assignment.

  5. Assign the Reader role to the Cloudaware application:

    • On the Role tab, select Reader → Next.
    • On the Members tab, leave User, group, or service principal selected and click Select members.
    • Start typing the name of the Cloudaware application, e.g., cloudaware-api-access, and select it in the list. Click Select.

  6. Click Review + assign → Review + assign.

Subscription-Level Discovery​

Use this option if you want to limit discovery to selected subscriptions.

Grant access to each subscription you want Cloudaware to monitor:

  1. In the Azure portal, search for and select Subscriptions.
  2. Select the subscription.
  3. In the left pane under Manage, select the Access control (IAM) tab.
  4. Click + Add, then Add role assignment.
  5. Assign the Reader role to the Cloudaware application:
    • On the Role tab, select Reader → Next.
    • On the Members tab, leave User, group, or service principal selected and click Select members.
    • Start typing the name of the Cloudaware application, e.g., cloudaware-api-access, and select it in the list. Click Select.
  6. Click Review + assign → Review + assign.
tip

If you plan to use additional capabilities such as Key Vault metadata, AKS details, reservations, or tagging, assign the optional roles described in Least-Privilege Policies at the required scopes.

Choose an Authentication Method​

Select one of the credential methods:

  • Certificate (recommended) — uses a certificate uploaded to the Azure app registration.
  • Client secret — uses a client secret created for the app registration.
tip

Use certificates whenever possible because they are generally more secure and usually have longer lifetimes than secrets.

Generate a certificate in Cloudaware during onboarding and upload it to Azure:

  1. Open the Cloudaware application in Azure.
  2. Go to Certificates & secrets.
  3. Open the Certificates tab.
  4. Upload the certificate generated in Cloudaware.

Client Secret Authentication​

Create the secret in Azure:

  1. Open the Cloudaware application in Azure.
  2. Go to Certificates & secrets.
  3. Open the Client secrets tab.
  4. Click + New client secret.
  5. Create the secret:
    • Description: A meaningful name, e.g., ca-api-key.
    • Expires: Select 730 days (24 months) or set a custom expiration period.
    • Click Add.
  6. Click Copy to clipboard to copy the secret value.
  7. Store the secret securely.

Add Azure Active Directory in Cloudaware​

In Cloudaware, open the Microsoft Azure setup form:

  1. Go to Admin.
  2. Select Microsoft Azure.
  3. Click + ADD to add the directory.
    • If Microsoft Azure is already configured, click CONFIGURED → select the Active Directories tab and click + ADD ACTIVE DIRECTORY.
  4. Enter a name for the Azure directory.
  5. Enter the Active Directory ID (Tenant ID).
  6. Optional: check the Automatically Discover Subscriptions box for tenant-wide discovery (if configured in Azure).
  7. Select the Environment:
    • Azure
    • Azure China
    • Azure Government
    • Azure Germany
  8. Enter the Application ID (Client ID) of the app registration.
  9. Choose the authentication method:
    • Using Certificate: Click the Download certificate button and upload the certificate file in Azure (see the Certificate Authentication (Recommended) section above).
    • Using Client Secret: Insert the secret created in Azure (see the Client Secret Authentication section above).
  10. Click SAVE.

Cloudaware validates the connection and begins discovery.

Add Azure Subscriptions Manually​

Use this step if you did not enable automatic discovery, or if you want to control which subscriptions are monitored.

  1. In Cloudaware, go to Admin.
  2. Select Microsoft Azure.
  3. On the tab Subscriptions, click + ADD AZURE SUBSCRIPTION.
    • If Azure is already configured, click CONFIGURED → select the Subscriptions tab and click + ADD AZURE SUBSCRIPTION.
  4. Fill out the form:
    • Name: Enter the subscription name.
    • Subscription ID: Enter the subscription ID.
    • Active Directory: Select the associated Active Directory.
  5. Click SAVE.
note

Subscriptions listed on the Untracked Subscriptions tab are visible to Cloudaware in the directory, but Cloudaware does not have sufficient permissions to discover them. Assign the Reader role or higher in Azure, then return to Cloudaware, select the checkboxes next to the relevant subscriptions, and click TRACK SELECTED to rerun discovery.

Edit Azure Applications in Cloudaware​

Cloudaware stores credentials – such as the Azure Active Directory Application ID (Client ID) and Client Secret – in Azure Applications. An Azure Application is created only when Active Directory is added to Cloudaware.

To update the application credentials in Cloudaware:

  1. Go to Admin.
  2. Select Microsoft Azure → CONFIGURED.
  3. Open the Applications tab.
  4. Select the application, and click the three-dot menu → Edit.

Verify the Connection​

After setup:

  • Confirm that the Azure Active Directory connection shows a healthy status in Cloudaware.
  • Confirm that subscriptions show a healthy status after discovery runs.
  • Confirm that Azure resources begin to appear in CMDB.
  • If the directory or subscription remains unhealthy, review permissions, credentials, and role assignments.

For detailed steps, see Verification.

Next Steps​

  • Review Azure Service Coverage and Azure Resource Coverage to understand which Azure services and objects are discovered.
  • If any directories or subscriptions remain unhealthy (red) or no data appears after the first discovery cycle, check Troubleshooting or contact Cloudaware Support at support@cloudaware.com.