Setting up an Azure Integration

CloudQuery Platform authenticates with Azure either through workload identity federation, which stores no credentials, or through a service principal secret. Both use the Reader role.

Prerequisites

• A CloudQuery Platform account with admin access
• Azure CLI installed
• An Azure account with permissions to create app registrations (or service principals) and assign roles
• Your Azure subscription ID (find it in the Azure Portal subscriptions page)

Set up authentication

Choose one of the two methods below. Workload identity federation is recommended; the service principal secret flow follows it.

Option A: Workload identity federation

CloudQuery generates an az CLI script that creates an app registration, adds a federated identity credential pinned to your CloudQuery tenant alone, and assigns the Reader role. No secret is created, so there is nothing to store or rotate.

You need the Azure CLI and permission to create app registrations and assign roles in the tenant.

1. In CloudQuery Platform, go to Data Sources → Integrations. Click Add new integration and type Azure to find the Azure integration.
2. Under Choose authentication method, select Workload identity federation.

3. Click Generate setup script.

4. Copy the generated script and run it in a terminal logged in to the tenant you want CloudQuery to read:

   az login

5. The script prints two values when it finishes. Paste them back into CloudQuery:

   • Azure AD Tenant ID
   • Application (client) ID

6. Click Complete setup. There is no separate verification step — Entra ID enforces the exact issuer, subject, and audience match natively, so the Test and Continue token exchange in Configure the integration is the verification.

7. The script assigns Reader only on the scope it targeted. To sync a wider set of subscriptions, grant Reader to the app registration at the management group or subscription scope you need.

Continue at Configure the integration.

Option B: Service principal secret

Syncing from a single subscription

1. Open your terminal and log in to Azure:

az login

2. Register the security provider and create a service principal with Reader access:

# Register the security provider
az provider register --namespace 'Microsoft.Security'
 
# Create a service principal and grant Reader access
az ad sp create-for-rbac --name cloudquery-sp \
          --scopes /subscriptions/<YOUR_SUBSCRIPTION_ID> --role Reader

The command outputs credentials in this format:

{
  "appId": "YOUR_AZURE_CLIENT_ID",
  "displayName": "cloudquery-sp",
  "password": "YOUR_AZURE_CLIENT_SECRET",
  "tenant": "YOUR_AZURE_TENANT_ID"
}

3. Save these credentials; you need them when configuring the integration.

Syncing from multiple subscriptions

There are two approaches for multi-subscription setups:

1. Management group level access (recommended)

Scoping the service principal at the management group level allows automatic discovery of all subscriptions under the specified group(s), including subscriptions added later.

# Register the security provider
az provider register --namespace 'Microsoft.Security'
 
# Create service principal with Management Group access
az ad sp create-for-rbac --name cloudquery-sp-root-1 \
  --scopes /providers/Microsoft.Management/managementGroups/<YOUR_MANAGEMENT_GROUP_NAME> \
  --role Reader

2. Specific subscriptions access

To limit access to specific subscriptions, list them explicitly. This command grants access to all subscriptions you can currently access:

# Register the security provider
az provider register --namespace 'Microsoft.Security'
 
# Create service principal with access to specific subscriptions
az ad sp create-for-rbac --name cloudquery-sp \
  --scopes $(az account subscription list --query "[].id" -o tsv --only-show-errors | xargs) \
  --role Reader

Configure the integration

1. In the CloudQuery Platform sidebar, under Data Sources, click Integrations, then click Add new integration. On the New integration page, type Azure in the search field and click the Azure card.

2. Enter an Integration name (e.g. Azure), then set up authentication:

   • If you used workload identity federation (Option A), you already entered the tenant and client IDs during setup, so there is nothing to paste here. The connection is verified when you click Test and Continue below.
   • If you used a service principal secret (Option B), keep Service principal secret selected under Choose authentication method, then enter the service principal credentials in the fields provided:

   Field	Value
   Azure AD Tenant ID	tenant from the service principal output
   Service Principal App ID	appId from the service principal output
   Service Principal Password	password from the service principal output

3. Under Configure resources to sync, choose which subscriptions to include or exclude.

4. Click Continue to select the Azure services you want to sync.

5. Click Test and Continue to verify the configuration.

What gets synced

The Azure integration can sync hundreds of tables across Azure services. Some of the most commonly used tables include:

See the full Azure table list for all available tables.

Verify the integration

After your first sync completes, open the SQL Console and run these queries to confirm data arrived:

-- Count synced virtual machines
SELECT count(*) FROM azure_compute_virtual_machines

-- List synced subscriptions
SELECT DISTINCT subscription_id FROM azure_compute_virtual_machines

-- View storage accounts
SELECT subscription_id, name, location FROM azure_storage_accounts LIMIT 10

You can also browse your Azure resources in the Asset Inventory under the Compute, Storage, Networking, and other categories.

Troubleshooting

Next steps

• Set up a sync to schedule when your Azure data is fetched
• Browse synced resources in the Asset Inventory
• Run advanced queries in the SQL Console
• See the Azure integration documentation for full configuration options and table reference

Related resources

• Microsoft Entra Workload Identity Federation
• Azure CLI installation guide
• Azure Service Principal tutorial
• Azure Management Groups overview
• Azure RBAC built-in roles
• Azure resource providers and types
• CloudQuery Azure integration on Hub