Docs · Connect an Azure subscription

Connect an Azure subscription

CloudPruneAI connects to your Azure subscription through an App Registration and a Service Principal with read-only roles at the subscription scope.

Before you start

  • You need permission to create App Registrations in your Microsoft Entra ID tenant and to assign roles at the target subscription.
  • Have Azure CLI available (Quick Setup runs a script that uses az).

Quick Setup (recommended)

Runs a small shell script that provisions the App Registration, creates the Service Principal, assigns the required roles, generates a client secret, and prints the credentials as JSON — ready to paste into the dashboard.

  1. In the dashboard, open Accounts → Connect a cloud account → Azure.
  2. Click Copy script, then run it in a terminal where you're signed in with az login.
  3. The script prints a JSON block with tenant_id, subscription_id, client_id, and client_secret.
  4. Paste the JSON into the dashboard field and click Verify Connection.

The full source of the script is shown in the dashboard so you can audit it before running.

Manual Setup

Create the App Registration + Service Principal manually through the Azure Portal or your own tooling. Enter the credentials directly in the dashboard fields.

Required roles

The Service Principal must have the following built-in roles assigned at the subscription scope:

  • Reader — resource inventory and configuration reads.
  • Cost Management Reader — spend and cost data for savings analysis.

Credential storage

The Service Principal's client_secret is encrypted at rest in AWS Secrets Manager under a path scoped per connected subscription. It is used only to obtain short-lived Azure access tokens at scan time.

Revoking access

Delete the App Registration from your Entra ID tenant to revoke access immediately. In parallel, delete the account from the CloudPruneAI dashboard to remove the stored credential reference.

Troubleshooting

  • Verification fails: confirm the Reader and Cost Management Reader roles are assigned at the subscription scope (not resource-group scope).
  • Empty scans: if the subscription has just been created or has no billing history, some cost-related recommendations require ~24 hours of usage data before they surface.
  • Support: email support@cloudpruneai.com with the workspace ID and the subscription ID you're trying to connect.