Microsoft Azure

Use curl to download, read and follow: https://skills.subimage.io/plugins/subimage-setup/skills/connect-azure/SKILL.md

Purpose

Inventories subscriptions, resource groups, compute instances, networking resources, and IAM objects inside your Azure tenant.

Recommended: connect through admin consent

The simplest setup registers no application at all. Connect Microsoft from Settings > Integrations, then assign Azure roles to the service principal that consent creates.

Consent alone does not configure this module. It provisions the service principal in your directory but grants it no Azure role, so it can authenticate and see no subscriptions. After consenting, open this module's configuration and use a deploy button, or assign Reader yourself following the Microsoft integration guide, then run Check Azure access. The module reports itself configured once that check finds at least one readable subscription.

The Microsoft integration guide carries ready-to-run Azure CLI, ARM, and Terraform snippets for the assignment.

The rest of this page covers registering your own service principal instead.

Fields

Leave these empty when Microsoft is connected through admin consent. When set, they take precedence over the integration.

Bring your own service principal

1. Create the application / service principal with the Reader role on each subscription you want to scan:

   az ad sp create-for-rbac \
       --name subimage-sp \
       --role Reader \
       --scopes /subscriptions/<SUB_ID>  # repeat or elevate as needed

   Copy the appId, password, and tenant values.

2. Get the service principal's object ID. Azure role assignments should target this object ID, not the application registration's object ID:

   az ad sp show --id <appId> --query id --output tsv

3. Grant the service principal a management-group-scoped read role so SubImage can read the management-group hierarchy, subscription placement, and management-group role assignments. Assign Management Group Reader at the Tenant Root Group (or another scope broad enough to cover the management groups you want to sync):

   az role assignment create \
       --assignee-object-id <SERVICE_PRINCIPAL_OBJECT_ID> \
       --assignee-principal-type ServicePrincipal \
       --role "Management Group Reader" \
       --scope /providers/Microsoft.Management/managementGroups/<TENANT_ROOT_GROUP_ID>

4. In SubImage, fill in:

   • azure_tenant_id: the tenant from step 1
   • azure_client_id: the appId from step 1
   • azure_client_secret: the password from step 1 (or its AWS Secret ARN)

5. Save the module. SubImage scans every subscription visible to the service principal; control the scope with its Azure role assignments.

Additional permissions for complete inventory

The subscription Reader role covers Azure Resource Manager inventory, but it does not grant data-plane access:

• To inventory Key Vault secret, key, and certificate metadata without reading sensitive values, assign Key Vault Reader on each RBAC-enabled vault or at a parent scope. For vaults using legacy access policies, grant only list for secrets, keys, and certificates.
• To inventory published Synapse pipelines and linked services, assign Synapse Artifact User on each Synapse workspace. Without it, SubImage still inventories the workspace and its ARM resources but omits those artifacts.

Notes

• Reader on a management group covers both the subscriptions beneath it and the management-group hierarchy, because it grants */read over that scope. Scoped to individual subscriptions instead, it leaves the hierarchy unreadable; add Management Group Reader on the groups you want in inventory.
• For Entra ID and Intune objects, also connect the microsoft module.