> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect an Azure Subscription to InfraAudit

> Create a service principal with Reader and Cost Management Reader roles, then connect your Azure subscription to sync VMs, Storage, and billing data.

InfraAudit connects to Azure using a service principal. Once connected, it discovers Virtual Machines, Storage Accounts, SQL Servers, and resource groups, and ingests billing data from the Azure Cost Management API.

## Prerequisites

* An Azure subscription
* The Azure CLI installed and authenticated, or access to the Azure portal
* Permission to create app registrations and assign roles in the subscription

## Create the service principal

Use the Azure CLI to create a service principal with the Reader role scoped to your subscription:

```bash theme={null}
az ad sp create-for-rbac \
  --name "infraudit-reader" \
  --role Reader \
  --scopes /subscriptions/<subscription-id> \
  --output json
```

The command returns the credentials you'll need when connecting:

```json theme={null}
{
  "clientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "subscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}
```

<Warning>
  Copy the `clientSecret` now — Azure does not show it again after the initial creation.
</Warning>

## Required roles

| Role                     | Scope        | Purpose                                                                          |
| ------------------------ | ------------ | -------------------------------------------------------------------------------- |
| `Reader`                 | Subscription | Read all resource metadata (VMs, Storage Accounts, SQL Servers, resource groups) |
| `Cost Management Reader` | Subscription | Read billing data via the Cost Management API                                    |

The `Reader` role is assigned automatically by the `create-for-rbac` command above. To also enable billing data ingest, assign the `Cost Management Reader` role separately:

```bash theme={null}
az role assignment create \
  --assignee <clientId> \
  --role "Cost Management Reader" \
  --scope /subscriptions/<subscription-id>
```

## Connect your Azure subscription

<Tabs>
  <Tab title="UI">
    <Steps>
      <Step title="Open the connection dialog">
        In the sidebar, click **Cloud Providers → Connect Azure**.
      </Step>

      <Step title="Enter your credentials">
        Fill in all four values from the `create-for-rbac` output:

        * **Client ID** (`clientId`)
        * **Client Secret** (`clientSecret`)
        * **Tenant ID** (`tenantId`)
        * **Subscription ID** (`subscriptionId`)
        * **Display name** — a label for this account in the InfraAudit UI
      </Step>

      <Step title="Connect">
        Click **Connect**. InfraAudit validates the service principal and starts the initial resource sync.
      </Step>
    </Steps>
  </Tab>

  <Tab title="CLI">
    ```bash theme={null}
    infraudit provider connect azure \
      --client-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
      --client-secret "your-client-secret" \
      --tenant-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
      --subscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
      --name "Azure Production"
    ```
  </Tab>

  <Tab title="API">
    ```bash theme={null}
    curl -X POST http://localhost:8080/api/v1/providers/azure/connect \
      -H "Authorization: Bearer $TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "name": "Azure Production",
        "clientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "clientSecret": "your-client-secret",
        "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "subscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
      }'
    ```
  </Tab>
</Tabs>

## What gets synced

| Resource type    | Internal type name      |
| ---------------- | ----------------------- |
| Virtual Machines | `azure_virtual_machine` |
| Storage Accounts | `azure_storage_account` |
| SQL Servers      | `azure_sql_server`      |
| Resource Groups  | `azure_resource_group`  |

Billing data is synced daily from the Azure Cost Management API.

## Security notes

* Credentials are encrypted at rest using AES-GCM.
* InfraAudit never writes to your Azure subscription. All API calls are read-only.
* Azure AD app client secrets expire — by default after 2 years. Set a calendar reminder to rotate the secret before it expires, then update the provider credentials in InfraAudit under **Cloud Providers → Edit**.