An Azure connection covers a set of subscriptions through one Entra application granted read-only access.

You need a Teams licence and cloud_connections.manage on the owning organisation or team.

In Entra, register an application and create a client secret on it. Azure shows the secret value once.

Grant Reader

Assign the built-in Reader role to that application at subscription scope, on every subscription you want visible. Where policy forbids built-in Reader, the wizard offers a narrower custom role definition to create instead.

Enter the three values

Open Settings → Continuum, choose New connection, then Azure. Enter the Directory (tenant) ID, the Application (client) ID and the Client secret value. The secret value, not the secret id.

Verify

Blueprintr authenticates, lists the subscriptions the application can see, and reads one resource group.

The Federation tile beside Client secret is marked roadmap and cannot be selected yet, so the client-secret path is the only one available.

Secret lifetime

You create the secret in Azure, so Azure decides how long it lives. The copy-and-run script the wizard offers creates it with a two-year life. The portal click-path leaves Azure's own default, so check it before relying on the connection.

Blueprintr encrypts the secret at rest and never returns it to the browser. Replace it later from the connection's detail page rather than by rebuilding the connection.

If verification fails

A connection whose application has no Reader grant fails outright: "The connection authenticated but no subscriptions are visible to it. Assign the Reader role at subscription scope." Grant Reader, then verify again.

Discovery only runs on a connection that has verified, so verify after any credential change.

Terraform state

A Terraform backend can be set on an Azure connection's detail page, but drift reconciliation works on AWS connections only. The form is not provider-gated, so an Azure connection accepts a backend and returns nothing from it.

Scopes and syncing covers choosing subscriptions and locations, and running the first sync.

Secret lifetime

If verification fails

Terraform state

Next

Connecting Azure