Skip to main content

Connect an Azure Account (CloudCADI Hosted on AWS)

Prerequisites​

Before you start

Open CloudCADI's Azure onboarding page and note down the three values shown there - Issuer, Subject, and Audience.

CloudCADI Azure prerequisite values

Azure Configuration

Step 1 – Service Principal Configuration and Access Control​

This section describes the configuration required to enable authentication for CloudCADI and grant the necessary permissions to access Azure resources and read data from Log Analytics.

1. Register an Application​

  1. Log in to the Azure Portal and open Microsoft Entra ID.

    Microsoft Entra ID

  2. Expand the Manage section and click App registrations.

    App Registrations

  3. Click New registration.

  4. Enter the application name and register it.

    alt text

2. Configure the Federated Credential​

  1. Open the newly registered application.

  2. Go to Certificates & secrets.

  3. Select the Federated credentials tab.

  4. Click Add credential.

    add credential

  5. Select Other issuer from the credential type dropdown.

    other issuer

  6. Enter the Issuer, Subject, and Audience values noted from CloudCADI's Azure onboarding page , enter them in the Azure Add a credential page as follows:

    • Issuer → CloudCADI Issuer
    • Value → CloudCADI Subject
    • Audience → CloudCADI Audience (click Edit if required)

    add issuer credentials

Step 2 – Assign the Reader Role at the Subscription Level​

  1. Open the required Subscription in the Azure Portal.

  2. Select Access control (IAM) from the left-side menu.

  3. Click + Add.

  4. Select Add role assignment.

    assign reader role

    Role Assignment
    • Reader
    • Log Analytics Contributor
    • Monitoring Contributor
    • Virtual Machine Contributor
    • Azure Kubernetes Service Contributor Role
    • Cost Management Contributor
    • Storage Account Contributor
    • Storage Blob Data Reader - assign this one on the subscription where cost data is exported

    add issuer credentials

  5. Under Assign access to, select User, group, or service principal.

  6. Click + Select members.

  7. Search for and select the service principal created during the application registration process.

  8. Click Next.

    service principal

  9. Click Review + assign to complete the role assignment.

    review and assign

Azure Tenant Onboarding​

Step 1: Access the CloudCADI Onboarding Section​

  1. Log in to CloudCADI using an Admin account.

  2. From the left navigation menu, click Admin Dashboard, then select the Onboarding tab and click Manage Cloud Accounts.

    Admin Dashboard

  3. Under Select Provider, choose Azure. On the Tenant Onboarding tab, enter the Account Name, Tenant ID, and Client ID, then click Next.

    Azure credentials step

How to get Tenant Id, Client Id ?
  • Login to your Azure Portal.
  • Open the Microsoft Entra ID and click on App registration.
  • Open the Service principal which you created or selected during Managed App Creation.
  • Under the Overview tab, copy the Application (client) ID and the Directory (tenant) ID.

tenant id client id

  1. Enter the Workspace ID, DCR name, and Storage account name, then click Next.

    Azure data collection step

How to get DCR name ?
  • Login to your Azure Portal.
  • Search for Data Collection Rules.
  • Select the name which you have created during the setting up of data collection rule.

data collection

data collection name

How to get Workspace Id ?
  • Login to your Azure Portal.
  • Search for Log Analytics workspaces, and go to your workspace where diagnostic settings is enabled for all resources.
  • Copy the Workspace ID.

workspace

workspace id

How to get Storage account name ?
  • Login to your Azure Portal.
  • Search for Storage accounts, and select the storage account name where you need to create the cost export.

storage account

  1. After clicking Next, review the Credentials and Data Collection details on the Confirmation page.

    Azure confirmation step

  2. Select the subscription from the list where the cost export needs to be created.

  3. For that, some permissions are required. For the onboarding subscription's storage account, two roles are needed: Storage Account Contributor and Storage Blob Data Contributor. And for the subscription where the cost export is created, one role is needed: Cost Management Contributor.

  4. After clicking Done, the cloud credentials are stored in the database and the cost export is stored in the storage account.

Manage Azure Subscriptions​

On an already-onboarded account, you can onboard any other available subscriptions under that same account.

Select the account, then the subscription, and click Enable Log Analytics. That subscription starts enabling Log Analytics, and its progress appears in the Onboarding Progress section.

Enable Log Analytics for a subscription