Skip to main content
Connect your Azure subscriptions to enable CloudThinker agents to analyze costs, audit compliance, and manage infrastructure across Microsoft Azure. Azure authenticates with a service principal (app registration + client secret + tenant ID); the principal’s role assignments determine what each agent can read.

​
Prerequisites

  • An Azure subscription with Owner or User Access Administrator access.
  • Permission to create app registrations in Azure Active Directory.
  • Permission to assign roles on the target subscriptions.
The Reader role is sufficient for cost analysis, security audits, and resource inspection. Grant write-level roles only if you need agents to take actions on Azure resources.

​
Setup

1

Register an application

Navigate to Azure Portal and go to Azure Active Directory → App registrations → New registration:
  • Name: CloudThinker-ReadOnly
  • Supported account types: Accounts in this organizational directory only
  • Click Register
2

Note application details

Copy and save these values from the app overview:
  • Application (client) ID
  • Directory (tenant) ID
3

Create a client secret

In your app registration, go to Certificates & secrets → New client secret. Add a description, set expiration (recommended: 12 months), and click Add. Copy the secret value immediately — it won’t be shown again.
4

Assign the Reader role

Go to Subscriptions → Your Subscription → Access control (IAM) → Add → Add role assignment. Select the Reader role, search for and select your app registration, and click Save.
5

Add the connection in CloudThinker

Navigate to Connections → Azure and enter:
  • Client ID (Application ID)
  • Client Secret (the secret value you copied)
  • Tenant ID (Directory ID)
  • Subscription ID
Click Connect. CloudThinker verifies the credentials and shows a Connected status.
Copy the client secret immediately after creation. Azure will not show it again, and you’ll need to create a new secret if lost.

​
Multi-subscription setup

For organizations with multiple Azure subscriptions:
1

Use Management Group access

Assign the Reader role at the Management Group level to cover all subscriptions in scope.
2

Add Cost Management access

Grant Cost Management Reader at the billing account level for cross-subscription cost analysis.
3

Configure in CloudThinker

Add all subscription IDs or select “All Subscriptions” in the connection settings.

​
Connection details

​
Required permissions

​
Minimum (read-only analysis)

Use the Reader role rather than Contributor; CloudThinker’s read operations never require write access. Set a rotation schedule for client secrets and avoid the “Never” expiration option.

​
Agent capabilities

Once connected, agents can analyze and optimize your Azure resources.

​
Verify the connection

​
Example prompts

​
Troubleshooting

Verify the Tenant ID, Client ID, and Client Secret are correct. Check that the client secret hasn’t expired and that the app registration is in the correct Azure AD tenant. Ensure no conditional access policies are blocking authentication.
Go to Azure AD → App registrations → Your app → Certificates & secrets, create a new client secret, and update the secret in the CloudThinker connection settings.
Verify the Reader role is assigned to the correct subscription(s). Check if resources are in a different subscription and ensure the app has access to all required subscriptions.
Verify the Cost Management Reader role is assigned. Check Cost Management + Billing access and ensure EA/MCA billing account access is configured if applicable.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Set secret expiration — always set an expiration on client secrets (avoid “Never”); set a calendar reminder to rotate before expiry.
  • Use Reader role — assign Reader rather than Contributor; CloudThinker’s read operations never require write access.

AWS Connection

Connect Amazon Web Services

Oliver Agent

Security-focused agent for Azure compliance