Azure

Connect your Azure subscription to enable CloudThinker agents to analyze costs, audit compliance, and manage infrastructure across Microsoft Azure. Azure authenticates with a service principal (app registration + client secret + tenant ID); the principal’s role assignments determine what each agent can read.

Prerequisites

An Azure subscription with Owner or User Access Administrator access.
Permission to create app registrations in Microsoft Entra ID.
Multi-factor authentication registered on your account. Security defaults block app registration without it.

Reader plus Cost Management Reader covers every read-only agent. Add write-level roles only if you want agents to change Azure resources.

Setup

Azure CLI
Azure portal

Select the subscription

az login
az account set --subscription <subscription-id>

Create the service principal

az ad sp create-for-rbac --name cloudthinker \
  --role Reader \
  --scopes /subscriptions/<subscription-id>

Copy the output. The password is shown once.

{
  "appId": "00000000-0000-0000-0000-000000000000",
  "displayName": "cloudthinker",
  "password": "the-client-secret",
  "tenant": "00000000-0000-0000-0000-000000000000"
}

Add cost access

az role assignment create --assignee <appId> \
  --role "Cost Management Reader" \
  --scope /subscriptions/<subscription-id>

Add the connection in CloudThinker

Navigate to Connections → Azure and enter appId as APP_ID, password as CLIENT_SECRET, and tenant as TENANT_ID. Select AZURE_DEFAULT_REGION, then click Connect.Success state: the connection shows a Connected status.

Go to Azure Portal → Microsoft Entra ID → App registrations → New registration. Name it cloudthinker, keep the default account type, and click Register.

Copy the identifiers

On the app overview, copy the Application (client) ID and the Directory (tenant) ID.

Create a client secret

Go to Certificates & secrets → New client secret. Set an expiration of 12 months and click Add. Copy the secret Value immediately.

Assign the roles

Go to Subscriptions → your subscription → Access control (IAM) → Add role assignment. Assign Reader to the app registration, then repeat for Cost Management Reader.

Add the connection in CloudThinker

Navigate to Connections → Azure and enter the client ID as APP_ID, the secret value as CLIENT_SECRET, and the directory ID as TENANT_ID. Select AZURE_DEFAULT_REGION, then click Connect.Success state: the connection shows a Connected status.

Copy the client secret immediately after creation. Azure never shows it again. Run az ad sp credential reset --id <appId> to issue a new one.

Microsoft Customer Agreement billing

Pay-as-you-go subscriptions bought online use a Microsoft Customer Agreement (MCA). Cost Management answers an MCA subscription with Given subscription doesn't have valid WebDirect/AIRS offer type, so Optimize reads spend at the billing profile instead. Grant the service principal access to that scope: go to Cost Management + Billing → your billing account → Billing profiles → your profile → Access control (IAM) → Add, and assign Billing profile reader to the app registration. Subscription role assignments do not cover billing scopes.

Connection details

Field	Description	Example
APP_ID	Application (client) ID of the app registration	`00000000-0000-0000-0000-000000000000`
CLIENT_SECRET	Secret value from Certificates & secrets	—
TENANT_ID	Directory (tenant) ID of your Microsoft Entra ID	`00000000-0000-0000-0000-000000000000`
AZURE_DEFAULT_REGION	Default region for Azure CLI calls	`East US`

The subscription is not a connection field. CloudThinker discovers every subscription the service principal can read.

Required permissions

Role	Scope	Grants
Reader	Subscription	Resource inventory, security audits, performance analysis
Cost Management Reader	Subscription	Optimize spend, forecast, and cost recommendations
Billing profile reader	MCA billing profile	Optimize on a Microsoft Customer Agreement subscription
Contributor	Subscription	Optional. Approval-gated write actions on resources

Reader alone returns no cost data. Reader grants */read, and a Cost Management query is a POST action that */read does not match.

Assign Contributor only when you want agents to change resources. Every write call still waits for your approval in chat.

Agent capabilities

Once connected, agents can analyze and optimize your Azure resources.

Agent	Azure capabilities
Alex	Cost analysis, VM right-sizing, Reserved Instance recommendations, resource optimization
Oliver	Security Center findings, Microsoft Entra ID audits, compliance checks, policy violations
Tony	SQL Database performance, Cosmos DB optimization, PostgreSQL tuning
Kai	AKS cluster management, container optimization, workload analysis

Verify the connection

@alex run an Azure account check and list the connected subscriptions and resource groups

Example prompts

@alex analyze Azure VM costs over the last 30 days and #recommend right-sizing opportunities
@oliver audit Azure Security Center findings and flag high-severity policy violations
@kai check AKS cluster health and #report any failing pods or resource pressure

Troubleshooting

az login or the portal returns AADSTS530035: Access has been blocked by security defaults. Security defaults require multi-factor authentication before you can register an app. Register a method at aka.ms/mfasetup and sign in again. The --use-device-code and --allow-no-subscriptions flags do not bypass this.

Authentication failed

Verify APP_ID, CLIENT_SECRET, and TENANT_ID. Check that the secret has not expired and that the app registration lives in the tenant you entered. Confirm no conditional access policy blocks service principal sign-in.

Client secret expired

Run az ad sp credential reset --id <appId>, or go to Microsoft Entra ID → App registrations → your app → Certificates & secrets and create a new secret. Update CLIENT_SECRET in the connection.

No cost data in Optimize

Optimize reports Azure Cost Management is not readable. Assign Cost Management Reader on the subscription. If the subscription uses a Microsoft Customer Agreement, also assign Billing profile reader on the billing profile. Role assignments take a few minutes to propagate.

Cost Management returns 429

A new subscription throttles Cost Management heavily, and the query answers 429 Too many requests. Nothing is misconfigured. Wait a few minutes and reload Optimize.

Missing resources

Verify the Reader role is assigned on every subscription you expect to see. Resources in a subscription the service principal cannot read never appear.

Security

Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

Set secret expiration — always set an expiration on client secrets, and rotate before expiry.
Scope the roles — assign Reader and Cost Management Reader on the subscriptions CloudThinker needs, not at management group level by default.

AWS Connection

Connect Amazon Web Services

Oliver Agent

Security-focused agent for Azure compliance

Organization

Agents

Automation & Autonomy

Connections

Platform Settings

Security

Billing

Prerequisites

Setup

Microsoft Customer Agreement billing

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Troubleshooting

Security

AWS Connection

Oliver Agent

​Prerequisites

​Setup

​Microsoft Customer Agreement billing

​Connection details

​Required permissions

​Agent capabilities

​Verify the connection

​Example prompts

​Troubleshooting

​Security

​Related

AWS Connection

Oliver Agent

Prerequisites

Setup

Microsoft Customer Agreement billing

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Troubleshooting

Security

Related