> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure

> Connect Microsoft Azure to CloudThinker for multi-cloud operations, cost analysis, and compliance monitoring

Connect your Azure subscriptions to enable CloudThinker agents to analyze costs, audit compliance, and manage infrastructure across Microsoft Azure.

Azure authenticates with a **service principal** (app registration + client secret + tenant ID); the principal's role assignments determine what each agent can read.

***

## Prerequisites

* An Azure subscription with Owner or User Access Administrator access.
* Permission to create app registrations in Azure Active Directory.
* Permission to assign roles on the target subscriptions.

<Info>
  The Reader role is sufficient for cost analysis, security audits, and resource inspection. Grant write-level roles only if you need agents to take actions on Azure resources.
</Info>

***

## Setup

<Steps>
  <Step title="Register an application">
    Navigate to [Azure Portal](https://portal.azure.com/) and go to **Azure Active Directory → App registrations → New registration**:

    * **Name**: `CloudThinker-ReadOnly`
    * **Supported account types**: Accounts in this organizational directory only
    * Click **Register**
  </Step>

  <Step title="Note application details">
    Copy and save these values from the app overview:

    * **Application (client) ID**
    * **Directory (tenant) ID**
  </Step>

  <Step title="Create a client secret">
    In your app registration, go to **Certificates & secrets → New client secret**. Add a description, set expiration (recommended: 12 months), and click **Add**. Copy the secret value immediately — it won't be shown again.
  </Step>

  <Step title="Assign the Reader role">
    Go to **Subscriptions → Your Subscription → Access control (IAM) → Add → Add role assignment**. Select the **Reader** role, search for and select your app registration, and click **Save**.
  </Step>

  <Step title="Add the connection in CloudThinker">
    Navigate to **Connections → Azure** and enter:

    * **Client ID** (Application ID)
    * **Client Secret** (the secret value you copied)
    * **Tenant ID** (Directory ID)
    * **Subscription ID**

    Click **Connect**. CloudThinker verifies the credentials and shows a **Connected** status.
  </Step>
</Steps>

<Warning>
  Copy the client secret immediately after creation. Azure will not show it again, and you'll need to create a new secret if lost.
</Warning>

### Multi-subscription setup

For organizations with multiple Azure subscriptions:

<Steps>
  <Step title="Use Management Group access">
    Assign the Reader role at the Management Group level to cover all subscriptions in scope.
  </Step>

  <Step title="Add Cost Management access">
    Grant **Cost Management Reader** at the billing account level for cross-subscription cost analysis.
  </Step>

  <Step title="Configure in CloudThinker">
    Add all subscription IDs or select "All Subscriptions" in the connection settings.
  </Step>
</Steps>

***

## Connection details

| Field               | Description                                     | Example                                |
| ------------------- | ----------------------------------------------- | -------------------------------------- |
| **Client ID**       | Application (client) ID of the app registration | `00000000-0000-0000-0000-000000000000` |
| **Client Secret**   | Secret value created in Certificates & secrets  | —                                      |
| **Tenant ID**       | Directory (tenant) ID of your Azure AD          | `00000000-0000-0000-0000-000000000000` |
| **Subscription ID** | Azure subscription ID to connect                | `00000000-0000-0000-0000-000000000000` |

***

## Required permissions

### Minimum (read-only analysis)

```
Reader                          # Basic read access to resources
Cost Management Reader          # Cost and billing data
```

### Recommended (full analysis)

```
# All of the above, plus:
Security Reader                 # Security Center access
Log Analytics Reader            # Log Analytics workspace access
Monitoring Reader               # Azure Monitor access
```

<Tip>
  Use the Reader role rather than Contributor; CloudThinker's read operations never require write access. Set a rotation schedule for client secrets and avoid the "Never" expiration option.
</Tip>

***

## Agent capabilities

Once connected, agents can analyze and optimize your Azure resources.

| Agent                              | Azure capabilities                                                                       |
| ---------------------------------- | ---------------------------------------------------------------------------------------- |
| **[Alex](/guide/agents/alex)**     | Cost analysis, VM right-sizing, Reserved Instance recommendations, resource optimization |
| **[Oliver](/guide/agents/oliver)** | Security Center findings, Azure AD audits, compliance checks, policy violations          |
| **[Tony](/guide/agents/tony)**     | SQL Database performance, Cosmos DB optimization, PostgreSQL tuning                      |
| **[Kai](/guide/agents/kai)**       | AKS cluster management, container optimization, workload analysis                        |

### Verify the connection

```text theme={null}
@alex run an Azure account check and list the connected subscriptions and resource groups
```

### Example prompts

```text theme={null}
@alex analyze Azure VM costs over the last 30 days and #recommend right-sizing opportunities
@oliver audit Azure Security Center findings and flag high-severity policy violations
@kai check AKS cluster health and #report any failing pods or resource pressure
```

***

## Troubleshooting

<Accordion title="Authentication failed">
  Verify the Tenant ID, Client ID, and Client Secret are correct. Check that the client secret hasn't expired and that the app registration is in the correct Azure AD tenant. Ensure no conditional access policies are blocking authentication.
</Accordion>

<Accordion title="Client secret expired">
  Go to **Azure AD → App registrations → Your app → Certificates & secrets**, create a new client secret, and update the secret in the CloudThinker connection settings.
</Accordion>

<Accordion title="Missing resources">
  Verify the Reader role is assigned to the correct subscription(s). Check if resources are in a different subscription and ensure the app has access to all required subscriptions.
</Accordion>

<Accordion title="No cost data">
  Verify the **Cost Management Reader** role is assigned. Check Cost Management + Billing access and ensure EA/MCA billing account access is configured if applicable.
</Accordion>

***

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Set secret expiration** — always set an expiration on client secrets (avoid "Never"); set a calendar reminder to rotate before expiry.
- **Use Reader role** — assign Reader rather than Contributor; CloudThinker's read operations never require write access.

***

## Related

<CardGroup cols={2}>
  <Card title="AWS Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/aws.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=45d526a3e9345214c0345f277da2e829" href="/guide/connections/aws" width="24" height="24" data-path="images/icons/aws.svg">
    Connect Amazon Web Services
  </Card>

  <Card title="Oliver Agent" icon="shield-check" href="/guide/agents/oliver">
    Security-focused agent for Azure compliance
  </Card>
</CardGroup>