> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/connectors/azure-cloud.md).

# Azure Cloud

Connect Azure subscriptions for infrastructure inventory and cloud posture. This is separate from [Azure DevOps](/connectors/azure.md) repositories and boards, and from Microsoft sign-in.

## Scope and access

The supported Terraform connector creates an Entra application and service principal with **Reader** access to either a management group or an explicit subscription list. Management-group scope includes its child subscriptions; use subscription scope when that is the intended boundary.

The default authentication mode is **Workload Identity Federation**: a federated credential trusts the Nullify issuer and tenant subject without creating a client secret. Before deploying Terraform, obtain the issuer URL and raw Nullify tenant ID from Nullify support or your Nullify representative. Azure settings cannot display these values until a configuration has already been saved. The Terraform module adds the `nullify-tenant:` subject prefix; do not add it yourself.

## Install

1. Sign in to the correct Azure tenant with `az login`.
2. Use the [Azure Terraform connector](https://github.com/Nullify-Platform/nullify-cloud-connector/tree/main/azure-integration-setup/terraform). Copy its example variables and set `customer_name`, `scope`, the management-group ID or subscription IDs, `nullify_oidc_issuer_url`, and `nullify_tenant_id`.
3. Review `terraform plan` before applying. The installer needs rights to create the application/federated credential and assign Reader at the selected scope.
4. Copy the `entra_tenant_id` and `application_client_id` outputs into **Settings → Connectors → Azure**, choose **Workload Identity Federation**, and select **Save changes**.
5. After saving, validate the stored federation with `POST /admin/integrations/cloud/azure/validate` (or ask Nullify to validate it). The current settings panel does not provide a separate Verify button.
6. Check inventory and scan status for each intended subscription.

If federation cannot be used, the console also supports a service-principal client secret. The module deliberately does not generate that secret. Create and rotate it through your organization's approved Entra process.

## Optional directory coverage

`enable_directory_read` defaults to false. Enabling it adds Microsoft Graph `Directory.Read.All` and `Policy.Read.All` for directory and conditional-access analysis. These are tenant-wide permissions beyond ARM Reader and require an appropriately privileged administrator's consent. Leave the option off when resource/RBAC coverage is sufficient.

AKS collection is configured through the [Kubernetes connector](/connectors/kubernetes.md); connecting subscriptions alone does not imply access to Kubernetes workload objects. Revoke federation by deleting the relevant federated credential and remove role assignments when disconnecting access.