Skip to main content
InfraAudit connects to Azure using a service principal. Once connected, it discovers Virtual Machines, Storage Accounts, SQL Servers, and resource groups, and ingests billing data from the Azure Cost Management API.

​
Prerequisites

  • An Azure subscription
  • The Azure CLI installed and authenticated, or access to the Azure portal
  • Permission to create app registrations and assign roles in the subscription

​
Create the service principal

Use the Azure CLI to create a service principal with the Reader role scoped to your subscription: 
az ad sp create-for-rbac \
  --name "infraudit-reader" \
  --role Reader \
  --scopes /subscriptions/<subscription-id> \
  --output json
The command returns the credentials you’ll need when connecting: 
{
  "clientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "subscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}
Copy the clientSecret now — Azure does not show it again after the initial creation.

​
Required roles

RoleScopePurpose
ReaderSubscriptionRead all resource metadata (VMs, Storage Accounts, SQL Servers, resource groups)
Cost Management ReaderSubscriptionRead billing data via the Cost Management API
The Reader role is assigned automatically by the create-for-rbac command above. To also enable billing data ingest, assign the Cost Management Reader role separately: 
az role assignment create \
  --assignee <clientId> \
  --role "Cost Management Reader" \
  --scope /subscriptions/<subscription-id>

​
Connect your Azure subscription

1

Open the connection dialog

In the sidebar, click Cloud Providers → Connect Azure.
2

Enter your credentials

Fill in all four values from the create-for-rbac output:
  • Client ID (clientId)
  • Client Secret (clientSecret)
  • Tenant ID (tenantId)
  • Subscription ID (subscriptionId)
  • Display name — a label for this account in the InfraAudit UI
3

Connect

Click Connect. InfraAudit validates the service principal and starts the initial resource sync.

​
What gets synced

Resource typeInternal type name
Virtual Machinesazure_virtual_machine
Storage Accountsazure_storage_account
SQL Serversazure_sql_server
Resource Groupsazure_resource_group
Billing data is synced daily from the Azure Cost Management API.

​
Security notes

  • Credentials are encrypted at rest using AES-GCM.
  • InfraAudit never writes to your Azure subscription. All API calls are read-only.
  • Azure AD app client secrets expire — by default after 2 years. Set a calendar reminder to rotate the secret before it expires, then update the provider credentials in InfraAudit under Cloud Providers → Edit.