Skip to main content
InfraAudit connects to Azure using a service principal. Once connected, it discovers Virtual Machines, Storage Accounts, SQL Servers, and resource groups, and ingests billing data from the Azure Cost Management API.

​
Prerequisites

  • An Azure subscription
  • The Azure CLI installed and authenticated, or access to the Azure portal
  • Permission to create app registrations and assign roles in the subscription

​
Create the service principal

Use the Azure CLI to create a service principal with the Reader role scoped to your subscription:
The command returns the credentials you’ll need when connecting:
Copy the clientSecret now — Azure does not show it again after the initial creation.

​
Required roles

The Reader role is assigned automatically by the create-for-rbac command above. To also enable billing data ingest, assign the Cost Management Reader role separately:

​
Connect your Azure subscription

1

Open the connection dialog

In the sidebar, click Cloud Providers → Connect Azure.
2

Enter your credentials

Fill in all four values from the create-for-rbac output:
  • Client ID (clientId)
  • Client Secret (clientSecret)
  • Tenant ID (tenantId)
  • Subscription ID (subscriptionId)
  • Display name — a label for this account in the InfraAudit UI
3

Connect

Click Connect. InfraAudit validates the service principal and starts the initial resource sync.

​
What gets synced

Billing data is synced daily from the Azure Cost Management API.

​
Security notes

  • Credentials are encrypted at rest using AES-GCM.
  • InfraAudit never writes to your Azure subscription. All API calls are read-only.
  • Azure AD app client secrets expire — by default after 2 years. Set a calendar reminder to rotate the secret before it expires, then update the provider credentials in InfraAudit under Cloud Providers → Edit.