Connect an Azure subscription

Snowtrol connects to Azure keylessly: an Entra ID application with a federated credential trusts Snowtrol's OIDC issuer, and the platform exchanges a signed assertion for a short-lived ARM token per request. There is no client secret and no stored key — the platform refuses to boot with an AZURE_CLIENT_SECRET in its environment. Discovery uses Azure Resource Graph/ARM (read-only) and cost comes from Cost Management.

Connect

1. 1
   Start the connection

   On Cloud accounts → Connect, choose Azure and enter your tenant ID and subscription ID (both GUIDs). The App (client) ID can be filled in after the script prints it.

2. 2
   Run the az script

   The connect panel renders a ready-to-run az script with your real resolved values: it registers an Entra app + service principal, creates the federated credential (pinned to Snowtrol's issuer and your connection's unique subject), and grants Reader plus Cost Management Reader on the subscription. It prints the App (client) ID.

3. 3
   Verify

   Enter the printed App (client) ID (reconnect if you connected without it) and click Verify connection. A healthy check starts the first sync; failures name the exact problem.

Azure syncs inventory (VMs, storage accounts, SQL, AKS, load balancers and more) plus network topology — VNets, subnets, NSGs, route tables, NAT gateways and private endpoints — and its NSGs feed the reachability engine. Azure deploy blueprints (storage account / VM / VNet) are available like any other cloud's.