# Connect Azure

> Connect your Azure tenant to CloudBolt Platform

---

Site [llms.txt](/llms.txt)

---

The process is automated: you authorize CloudBolt and select the subscriptions to include, and CloudBolt handles the rest.

<div class="alert alert-info" role="alert"><div class="h4 alert-heading" role="heading">Before you begin</div>


Ensure you have completed the steps in [Configure Azure tenants](/docs/cbp/getting-started/configure-cloud-accounts/azure/).
</div>


There are three stages to the onboarding process:

1. **Authorize:** Sign in to your Azure tenant and grant CloudBolt read-only consent
1. **Configure:** Select which subscriptions and billing scope to include
1. **Provision:** CloudBolt creates the required Azure resources and begins importing your cost data

The active part of this process takes approximately 10 minutes, after which time historical data import, if enabled, continues in the background.

## Prerequisites

Before you begin, ensure you have:

- Completed the steps in [Configure Azure tenants](/docs/cbp/getting-started/configure-cloud-accounts/azure/).
- A modern web browser with popups enabled for your CloudBolt Platform instance.
- Admin access to your CloudBolt Platform instance. Refer to [Manage roles](/docs/cbp/getting-started/manage-organizations-users-roles/roles/).

### Network requirements

The onboarding process requires the browser to reach:

- `login.microsoftonline.com`: Microsoft Entra ID authentication
- `management.azure.com`: Azure Resource Manager API
- `graph.microsoft.com`: Microsoft Entra ID Graph API (app registration)

## What CloudBolt creates

During onboarding, CloudBolt provisions the following resources using your administrator's credentials:

| Resource | Purpose | Scope |
| --- | --- | --- |
| App registration + service principal | Long-term read-only access via Workload Identity Federation | Microsoft Entra ID tenant |
| Custom role ("CloudBolt Reader") | Read-only access to cost, billing, and reservation data | Root management group |
| Resource group | Container for the storage account | Selected subscription |
| Storage account + blob container | Destination for Cost Management export files | Selected subscription |
| Cost Management exports | Daily FOCUS billing, price sheet, and reservation data | Billing account scope |
| RBAC role assignments | Grants the CloudBolt service principal read-only access | Management group, billing, and storage scopes |

**CloudBolt does not:**

- Modify or delete any of your existing cloud resources
- Access your application data, secrets, or key vaults
- Make changes to your billing configuration or spending
- Retain your administrator's credentials after onboarding

## Step 1: Start the Azure integration

1. Log in to the CloudBolt Platform. The address depends on where your organization's tenant is hosted; see [Sign in](/docs/cbp/getting-started/#sign-in).
1. In the sidebar, go to **Settings** > **Connections**.
1. Next to Azure, select **Add Connection**.
1. Select your Azure environment:
   - **Azure Commercial** (default)
   - **Azure Government**
1. Select **Authorize CloudBolt**.
1. A pop-up window opens for Azure sign-in. Sign in with an account that has the [required permissions](/docs/cbp/getting-started/configure-cloud-accounts/azure/#required-azure-permissions).

<div class="alert alert-info" role="alert"><div class="h4 alert-heading" role="heading">Pop-up blocked?</div>


Your browser may block the sign-in pop-up. Allow pop-ups for your CloudBolt Platform URL and try again.
</div>


## Step 2: Select your Azure tenant

If your Azure account has access to multiple Microsoft Entra ID tenants, you will be asked to select a tenant. Choose the tenant that contains the subscriptions you want CloudBolt to manage.

If your account has access to only one tenant, this step is automatic.

## Step 3: Review discovery results

After authorization, CloudBolt discovers your Azure environment:

- **Subscriptions:** All active Azure subscriptions in the tenant
- **Billing accounts:** Your Enterprise Agreement (EA), Microsoft Customer Agreement (MCA), or Microsoft Partner Agreement (MPA) billing hierarchy
- **Management group:** Your organizational structure (used for read-only access scoping)

CloudBolt also verifies that your account has the required access to complete onboarding. If permissions are missing, you will see a warning with instructions for resolution.

## Step 4: Select scope

On the scope selection screen:

1. **Review your subscriptions.** All active subscriptions are selected by default. Deselect any you do not want CloudBolt to monitor.
1. **Confirm billing scope.** CloudBolt auto-detects your billing account. If you have multiple billing accounts or profiles, select the one that covers your chosen subscriptions. Each billing account row displays its agreement type (for example, "Microsoft Customer Agreement") and a status badge; the resolved billing account type follows the account you select.
1. Select **Continue**.

<div class="alert alert-info" role="alert">


You can add or remove subscriptions later from the connection management page.
</div>


### Connect to indirect CSP subscriptions (if available)

Where subscriptions were discovered, a **Connect to indirect CSP subscriptions** link button may be available. This option is enabled per tenant, so you may not see it. Use it for indirect CSP scenarios where no billing account is accessible. CloudBolt onboards per-subscription cost exports instead of one billing account-scope export.

1. Select **Connect to indirect CSP subscriptions**. A dialog titled **Select subscriptions to onboard** opens, with a search box and a checklist of discovered subscriptions.
1. Check the subscriptions you want to onboard and confirm.

After confirming, the page shows a **Subscription scope** summary ("Scoped to \<n\> subscription(s)") with **Change** and **Use a billing account instead** links.

## Step 5: Configure provisioning

On the provisioning configuration screen:

1. **Provisioning subscription:** Select which subscription will host the storage account for cost export data. This should be a subscription that gives you Contributor access.
1. **Azure region:** Choose the region for the storage account (default: East US). For best performance, select a region close to your primary operations.
1. **Resource prefix:** The naming prefix for resources CloudBolt creates (default: `cloudbolt`). Change this if you have naming conventions to follow.
1. **Include historical data (recommended):** When enabled, CloudBolt imports 12 months of historical cost data so your dashboards and reports have full context from day one.

### CloudBolt-hosted storage (MPA only)

When the selected billing account is an MPA, a **Use CloudBolt-hosted storage (cross-tenant SAS)** switch appears. When enabled, CloudBolt creates the cost exports at the Azure billing scope and delivers them to CloudBolt-hosted storage via a container-scoped SAS token, so no storage account or subscription is needed in your tenant. In this mode, the provisioning subscription, region, and resource prefix fields are hidden.

### Advanced: management group scope

A collapsible **Advanced: management group scope** section controls where CloudBolt's read role is assigned:

- **Tenant root management group (default):** Assigns the role at the root, covering all subscriptions in the tenant.
- **Specific management group:** Choose a management group from the dropdown to limit the role assignment to that group.
- **Provisioning subscription only:** Limits inventory and security data to the provisioning subscription. Cost data is unaffected.

Options your service principal cannot serve are disabled with an explanatory tooltip. If your Azure admin will not grant role-assignment write at the root, pick a narrower scope.

## Step 6: Start provisioning

Select **Start Provisioning**. CloudBolt begins setting up your Azure environment.

A progress tracker shows each step in real time:

| Step | What happens | Duration |
| --- | --- | --- |
| Create resource group | Creates a resource group in your provisioning subscription | ~30 seconds |
| Create storage account | Creates a storage account with secure defaults | 1-2 minutes |
| Create blob container | Creates the container for cost export files | ~15 seconds |
| Create cost exports | Sets up 5 daily Cost Management exports (FOCUS billing, price sheet, reservations) | 1-2 minutes |
| Create custom role | Creates the "CloudBolt Reader" role with read-only permissions | ~30 seconds |
| Assign access | Grants the CloudBolt service principal read-only access to your billing and subscription data | 1-2 minutes |
| Validate connection | Verifies end-to-end data access works correctly | ~30 seconds |
| Import historical data (optional) | Downloads up to 12 months of historical cost data (if enabled) | 15-60 minutes |

**You can leave the page after the "Assign access" step completes.** The historical data import continues in the background.

### If a provisioning step fails

Non-critical steps, such as individual cost exports, may show as "skipped" without blocking the overall process. CloudBolt can function with partial data for those export types.

For critical failures:

1. Review the error message shown next to the failed step.
1. Select **Retry** to re-attempt the failed steps. Steps that have already succeeded are preserved.
1. If the issue persists, check the [Troubleshooting section](#troubleshooting).

## Step 7: Lighthouse delegation (MPA only)

This step is informational. If your billing account is an MPA, the wizard shows an informational card after provisioning completes, explaining that Azure Lighthouse delegations (cross-tenant read access to customer subscriptions for inventory data) are configured from the connection management page after onboarding completes.

## Step 8: Verify your connection

After provisioning completes, CloudBolt redirects you to the connection management page. Verify:

- **Status** shows "Configured"
- **Subscriptions** list those selected
- **Last validation** shows a recent successful check

Your cost data begins appearing in CloudBolt dashboards within 24 hours as Azure Cost Management generates its first daily export. Historical data (if enabled) appears as the background import completes.

## Manage your connection

After onboarding, you can manage your Azure connection from **Settings** > **Connections**:

### Update subscriptions

To add or remove subscriptions from a connection:

1. Open the connection.
1. Edit the subscription selection.
1. Save your changes.

CloudBolt updates the access scope without re-running the full provisioning process.

### Re-validate

Select **Validate** to run a health check that verifies CloudBolt can access your Azure data. This checks authentication, subscription access, cost data, and billing connectivity.

### SAS token rotation

For connections that use CloudBolt-hosted storage, the connection management page shows a **SAS Token** card with its **Expires** date and a **Rotate SAS** button. Rotation prompts a fresh Azure sign-in and mints a new token. Warnings appear when the token nears or passes expiry.

<div class="alert alert-info" role="alert">


Rotating the SAS token requires the same Azure permissions as onboarding.
</div>


### Disconnect

To remove CloudBolt's access to your Azure tenant:

1. Open the connection and select **Disconnect**.

**Result:** CloudBolt removes its configuration record.

<div class="alert alert-warning" role="alert"><div class="h4 alert-heading" role="heading">Manual cleanup required</div>


Disconnecting does not delete the Azure resources (resource group, storage account, app registration) created during onboarding. Delete these resources manually from the Azure Portal after disconnecting.
</div>


## Troubleshooting

### "Could not create resource group" or "Could not create storage account"

**Cause:** The onboarding user does not have Contributor access on the selected provisioning subscription.

**Fix:** Assign the Contributor role to the onboarding user on the subscription, then select Retry.

### "Could not create custom role"

**Cause:** The onboarding user does not have permission to create role definitions at the management group or subscription scope.

**Fix:** Ensure the user has the User Access Administrator or Owner role at the root management group. If management group access is not available, CloudBolt will attempt per-subscription role assignment as a fallback.

### "Could not assign roles" (partial)

**Cause:** Role assignment at the root management group was denied (403).

**Impact:** CloudBolt falls back to assigning roles to each individual subscription. This works, but it means newly added subscriptions will need manual onboarding.

**Fix:** To enable auto-discovery of future subscriptions, grant User Access Administrator permissions at the root management group, then retry.

### Cost data not appearing after 24 hours

1. **Check export status** in Azure Portal > Cost Management > Exports. Verify the exports CloudBolt created are active and have a recent "Last run" timestamp.
1. **Check storage account:** Verify files are being written to the blob container.
1. [**Re-validate** the connection in CloudBolt](#re-validate) to check for access issues.

### Pop-up blocked during authorization

Allow pop-ups for your CloudBolt Platform URL in your browser settings. The authorization flow requires a pop-up window for Azure sign-in.

### "Billing scope not found"

**Cause:** The onboarding user lacks read access to the billing account.

**Fix:** Assign Billing Account Reader (MCA/MPA) or Enrollment Reader (EA) to the onboarding user and restart the onboarding flow.

## What CloudBolt accesses

After onboarding, CloudBolt has **read-only** access to:

| Data | Purpose |
| --- | --- |
| Cost and billing data (FOCUS format) | Cost analysis, dashboards, anomaly detection |
| Price sheets | Accurate cost calculations and re-rating |
| Reserved Instance and Savings Plan data | Commitment utilization, coverage, and recommendations |
| Subscription and resource metadata | Inventory and resource organization |
| Management group hierarchy | Organizational context for cost allocation |

CloudBolt **cannot** modify your Azure resources, access application data, or change your billing configuration.

## Frequently asked questions

**Q: How long does onboarding take?**

The interactive portion takes about 10 minutes. Historical data import (if enabled) runs in the background for 15-60 minutes, depending on data volume.

**Q: Can I onboard multiple Azure tenants?**

Yes. Repeat the onboarding process for each Azure tenant. Each tenant gets its own connection in CloudBolt.

**Q: What happens if I add new subscriptions to my Azure tenant?**

If CloudBolt has management group-level access, new subscriptions are discovered automatically. If access is per-subscription, you will need to update the connection to include the new subscription.

**Q: Can I change the storage account location after onboarding?**

The storage account region is set during provisioning and cannot be changed afterward. To use a different region, disconnect and re-onboard.

**Q: Does CloudBolt store my Azure credentials?**

No. CloudBolt uses Workload Identity Federation (WIF) for ongoing access, which uses short-lived tokens exchanged through a trust relationship, so no passwords or secrets are stored. The onboarding user's credentials are used only during the setup process and are not retained.

**Q: What Azure resources are created, and who pays for them?**

CloudBolt creates a resource group, storage account, and blob container in your Azure subscription. The storage costs are minimal (typically under $5/month for most organizations) since Azure Cost Management exports are small compressed files. These resources are in your subscription and appear on your Azure bill.