# Microsoft Azure

![Azure-logo.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/7493156654989.png)
Microsoft Azure is a public cloud computing platform and online portal that allows you to access and manage cloud services and resources provided by Microsoft. It provides a range of cloud services including compute, analytics, storage and networking.

In order to integrate Microsoft Azure with Relyance AI you will need an Azure **Tenant ID**, **Subscription ID**, **Client ID**, and **Client Secret**. You will also need to provide a **Product** name that your would associate with the integration analysis.

#### In Microsoft Azure:

![AzureInfra-1.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/7495934101901.png)
![AzureInfra-2.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/7496057586317.png)
![AzureInfra-6.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/7496363501197.png)
![AzureInfra-3.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/7496061370509.png)
![AzureInfra-4.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/7496057362829.png)
![AzureInfra-5.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/21374822859405.png)
![AzureInfra-10.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/7497665892621.png)
![AzureInfra-11.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/7497961407245.png)
![AzureInfra-12.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/7498313394829.png)
#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Click on the **Infrastructure Integration** tab.
5. Find the **Microsoft Azure** integration card and click it to open its connections.
6. Under **Authentication Method**, choose **Custom**.

8. open the **Account Details** JSON editor.
9. **Account Details** is a JSON *array*, so one connection can cover several Azure subscriptions — add an object per subscription, pasting the **Tenant ID**, **Subscription ID**, **Client ID**, **Client Secret** and **Product** name into the respective quotes:

    ```json
    [
      {
        "tenant_id": "",
        "subscription_id": "",
        "client_id": "",
        "client_secret": "",
        "product": ""
      }
    ]
    ```
10. Click **Authenticate**.
11. At this point, you should see the following result on the **Infrastructure** Integrations page:

![AzureInfra-8.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/7496826789901.png)

![AzureInfra-9.png](https://assets.relyanceuat.xyz/images/docs/7493422421645/7496867984269.png)

12. Congratulations, you are now connected to **Microsoft Azure**.

### Verify the connection is really working

The connection authenticates as an Entra ID application per subscription —
**Tenant ID**, **Subscription ID**, **Client ID** and **Client Secret** in the
Account Details array — and requests `Data.Read` and `User.Read`.

1. **Connected but nothing discovered** is the role assignment. API permissions let
   the app authenticate; reading the subscription's resources needs a **Reader**
   role assignment on that subscription (or on the resource groups in scope). The
   app registration existing is not access.
2. **Some subscriptions return nothing.** Each object in the Account Details array
   is authorised independently — a role assignment missing on one subscription
   leaves that entry silently empty while the others work.
3. **A connection that worked and then stopped** is the client secret expiring.
   Entra secrets carry a hard expiry, so record it in the connection's **Credentials
   expiry** field.
4. **Client secrets in this field reach Terraform state.** The Account Details field
   is not flagged secret today, so if you manage this connection with Terraform the
   secret is written to state in cleartext — see the note in the Terraform section
   below.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "azure" {
  vendor = "azure"
  name   = "<your connection name>"

  auth = {
    method = "account-credentials"
    # NOTE: accounts carries credentials (client_secret) but is not flagged
    # secret, so it goes in params and IS written to Terraform state in
    # cleartext. Keep state in an encrypted remote backend with restricted
    # access, and rotate the credential if state was ever committed.
    params = {
      accounts = jsonencode([
        {
          client_id = ""
          client_secret = ""
          product = ""
          subscription_id = ""
          tenant_id = ""
        }
      ])
    }
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->