Azure Cloud

Connect Azure subscriptions for infrastructure inventory and cloud posture. This is separate from Azure DevOps repositories and boards, and from Microsoft sign-in.

Scope and access

The supported Terraform connector creates an Entra application and service principal with Reader access to either a management group or an explicit subscription list. Management-group scope includes its child subscriptions; use subscription scope when that is the intended boundary.

The default authentication mode is Workload Identity Federation: a federated credential trusts the Nullify issuer and tenant subject without creating a client secret. Before deploying Terraform, obtain the issuer URL and raw Nullify tenant ID from Nullify support or your Nullify representative. Azure settings cannot display these values until a configuration has already been saved. The Terraform module adds the nullify-tenant: subject prefix; do not add it yourself.

Install

1. Sign in to the correct Azure tenant with az login.

2. Use the Azure Terraform connector. Copy its example variables and set customer_name, scope, the management-group ID or subscription IDs, nullify_oidc_issuer_url, and nullify_tenant_id.

3. Review terraform plan before applying. The installer needs rights to create the application/federated credential and assign Reader at the selected scope.

4. Copy the entra_tenant_id and application_client_id outputs into Settings → Connectors → Azure, choose Workload Identity Federation, and select Save changes.

5. After saving, validate the stored federation with POST /admin/integrations/cloud/azure/validate (or ask Nullify to validate it). The current settings panel does not provide a separate Verify button.

6. Check inventory and scan status for each intended subscription.

If federation cannot be used, the console also supports a service-principal client secret. The module deliberately does not generate that secret. Create and rotate it through your organization's approved Entra process.

Optional directory coverage

enable_directory_read defaults to false. Enabling it adds Microsoft Graph Directory.Read.All and Policy.Read.All for directory and conditional-access analysis. These are tenant-wide permissions beyond ARM Reader and require an appropriately privileged administrator's consent. Leave the option off when resource/RBAC coverage is sufficient.

AKS collection is configured through the Kubernetes connector; connecting subscriptions alone does not imply access to Kubernetes workload objects. Revoke federation by deleting the relevant federated credential and remove role assignments when disconnecting access.