setup

Microsoft Azure

tip

Set up with an AI agent Using Claude Code, Cursor, Codex CLI, or another coding agent? The subimage-setup:connect-azure skill walks the agent through every choice on this page. Paste this into your agent:

Use curl to download, read and follow: https://skills.subimage.io/plugins/subimage-setup/skills/connect-azure/SKILL.md

Or install the marketplace once with claude plugin marketplace add subimagesec/skills. Full instructions on Agent Skills.

Purpose

Inventories subscriptions, resource groups, compute instances, networking resources, and IAM objects inside your Azure tenant.

tip

Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.

Required Fields

Field Secret? Description
azure_tenant_id No Azure Directory / Tenant ID
azure_client_id No Application (client) ID of the registered service principal
azure_client_secret Yes Client secret generated under Certificates & secrets

Setup Steps

  1. Create the application / service principal with the Reader role on each subscription you want to scan:

    az ad sp create-for-rbac \
    --name subimage-sp \
    --role Reader \
    --scopes /subscriptions/<SUB_ID>  # repeat or elevate as needed

    Copy the appId, password, and tenant values.

  2. Get the service principal's object ID. Azure role assignments should target this object ID, not the application registration's object ID:

    az ad sp show --id <appId> --query id --output tsv

  3. Grant the service principal a management-group-scoped read role so SubImage can read the management-group hierarchy, subscription placement, and management-group role assignments. Assign Management Group Reader at the Tenant Root Group (or another scope broad enough to cover the management groups you want to sync):

    az role assignment create \
    --assignee-object-id <SERVICE_PRINCIPAL_OBJECT_ID> \
    --assignee-principal-type ServicePrincipal \
    --role "Management Group Reader" \
    --scope /providers/Microsoft.Management/managementGroups/<TENANT_ROOT_GROUP_ID>

  4. In SubImage, fill in:

    • azure_tenant_id: the tenant from step 1
    • azure_client_id: the appId from step 1
    • azure_client_secret: the password from step 1 (or its AWS Secret ARN)

  5. Save the module. SubImage scans every subscription visible to the service principal; control the scope with its Azure role assignments.

Additional permissions for complete inventory

The subscription Reader role covers Azure Resource Manager inventory, but it does not grant data-plane access:

  • To inventory Key Vault secret, key, and certificate metadata without reading sensitive values, assign Key Vault Reader on each RBAC-enabled vault or at a parent scope. For vaults using legacy access policies, grant only list for secrets, keys, and certificates.
  • To inventory published Synapse pipelines and linked services, assign Synapse Artifact User on each Synapse workspace. Without it, SubImage still inventories the workspace and its ARM resources but omits those artifacts.

Notes

  • Reader covers subscription resource inventory. Management Group Reader supplies Microsoft.Management/managementGroups/read, management-group subscription reads, and role-assignment reads. Both are needed for complete hierarchy inventory.
  • For Entra ID and Intune objects, also connect the microsoft module.
On this page
PurposeRequired FieldsSetup StepsAdditional permissions for complete inventoryNotes