Azure

Connect Microsoft Azure to CloudThinker

Azure

Connect your Azure subscriptions to enable CloudThinker agents to analyze costs, optimize resources, and manage infrastructure across Microsoft Azure services.

---

Setup

1. Register Application

   Create an app registration in Azure AD

   1. Navigate to Azure Portal
   2. Go to Azure Active Directory → App registrations → New registration
   3. Enter application name: CloudThinker-ReadOnly
   4. Select Accounts in this organizational directory only
   5. Click Register
2. Note Application Details

   Copy and save these values from the app overview:

   • Application (client) ID
   • Directory (tenant) ID
3. Create Client Secret

   Generate a secret for authentication

   1. In your app registration, go to Certificates & secrets
   2. Click New client secret
   3. Add a description and set expiration (recommended: 12 months)
   4. Click Add
   5. Immediately copy the secret value (it won’t be shown again)
4. Assign Reader Role

   Grant access to your subscription(s)

   1. Go to Subscriptions → Your Subscription
   2. Click Access control (IAM) → Add → Add role assignment
   3. Select Reader role
   4. Search for and select your app registration
   5. Click Save
5. Add Connection in CloudThinker

   Navigate to Connections → Azure and enter:

   • Client ID (Application ID)
   • Client Secret (the secret value you copied)
   • Tenant ID (Directory ID)
   • Subscription ID

Copy the client secret immediately after creation. Azure will not show it again, and you’ll need to create a new secret if lost.

---

Required Roles

Minimum (Read-Only Analysis)

Reader                          # Basic read access to resources
Cost Management Reader          # Cost and billing data

Recommended (Full Analysis)

# All of the above, plus:
Security Reader                 # Security Center access
Log Analytics Reader           # Log Analytics workspace access
Monitoring Reader              # Azure Monitor access

---

Agent Capabilities

Once connected, agents can:

Agent	Azure Capabilities
Alex	Cost analysis, VM right-sizing, Reserved Instance recommendations, resource optimization
Oliver	Security Center findings, Azure AD audits, compliance checks, policy violations
Tony	SQL Database performance, Cosmos DB optimization, PostgreSQL tuning
Kai	AKS cluster management, container optimization, workload analysis

---

Multi-Subscription Setup

For organizations with multiple Azure subscriptions:

1. Management Group Access

   Assign Reader role at the Management Group level for all subscriptions

2. Add Cost Management Access

   Grant Cost Management Reader at the billing account level

3. Configure in CloudThinker

   Add all subscription IDs or select “All Subscriptions”

---

Troubleshooting

Authentication failed

• Verify Tenant ID, Client ID, and Client Secret are correct
• Check the client secret hasn’t expired
• Confirm the app registration is in the correct Azure AD tenant
• Ensure no conditional access policies are blocking

Client secret expired

• Go to Azure AD → App registrations → Your app
• Navigate to Certificates & secrets
• Create a new client secret
• Update the secret in CloudThinker connection settings

Missing resources

• Verify Reader role is assigned to the correct subscription(s)
• Check if resources are in a different subscription
• Ensure the app has access to all required subscriptions

No cost data

• Verify Cost Management Reader role is assigned
• Check Cost Management + Billing access
• Ensure EA/MCA billing account access if applicable

---

Security Best Practices

• Minimal permissions - Use Reader role, not Contributor
• Secret rotation - Rotate client secrets every 90 days
• Expiration - Set appropriate expiration on secrets (not “Never”)
• Audit logging - Enable Azure AD sign-in logs
• Conditional access - Consider IP restrictions for the app

---

Related

AWS Connection

Connect Amazon Web Services

Oliver Agent

Security-focused agent for Azure compliance