Microsoft Azure

Microsoft Azure is a public cloud computing platform and online portal that allows you to access and manage cloud services and resources provided by Microsoft. It provides a range of cloud services including compute, analytics, storage and networking.

In order to integrate Microsoft Azure with Relyance AI you will need an Azure Tenant ID, Subscription ID, Client ID, and Client Secret. You will also need to provide a Product name that your would associate with the integration analysis.

In Microsoft Azure:

In the Relyance AI application:

1. Login to your Relyance account.

2. Navigate to the Settings Menu in the bottom left-hand side.

3. Select Integrations.

4. Click on the Infrastructure Integration tab.

5. Find the Microsoft Azure integration card and click it to open its connections.

6. Under Authentication Method, choose Custom.

7. open the Account Details JSON editor.

8. Account Details is a JSON array, so one connection can cover several Azure subscriptions — add an object per subscription, pasting the Tenant ID, Subscription ID, Client ID, Client Secret and Product name into the respective quotes:

   [
     {
       "tenant_id": "",
       "subscription_id": "",
       "client_id": "",
       "client_secret": "",
       "product": ""
     }
   ]

9. Click Authenticate.

10. At this point, you should see the following result on the Infrastructure Integrations page:

12. Congratulations, you are now connected to Microsoft Azure.

Verify the connection is really working

The connection authenticates as an Entra ID application per subscription — Tenant ID, Subscription ID, Client ID and Client Secret in the Account Details array — and requests Data.Read and User.Read.

1. Connected but nothing discovered is the role assignment. API permissions let the app authenticate; reading the subscription's resources needs a Reader role assignment on that subscription (or on the resource groups in scope). The app registration existing is not access.
2. Some subscriptions return nothing. Each object in the Account Details array is authorised independently — a role assignment missing on one subscription leaves that entry silently empty while the others work.
3. A connection that worked and then stopped is the client secret expiring. Entra secrets carry a hard expiry, so record it in the connection's Credentials expiry field.
4. Client secrets in this field reach Terraform state. The Account Details field is not flagged secret today, so if you manage this connection with Terraform the secret is written to state in cleartext — see the note in the Terraform section below.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

resource "relyance_integration_connection" "azure" {
  vendor = "azure"
  name   = "<your connection name>"

  auth = {
    method = "account-credentials"
    # NOTE: accounts carries credentials (client_secret) but is not flagged
    # secret, so it goes in params and IS written to Terraform state in
    # cleartext. Keep state in an encrypted remote backend with restricted
    # access, and rotate the credential if state was ever committed.
    params = {
      accounts = jsonencode([
        {
          client_id = ""
          client_secret = ""
          product = ""
          subscription_id = ""
          tenant_id = ""
        }
      ])
    }
  }

  scans = { "data-inspection" = { enabled = true } }
}