Azure

First, register an application in your Azure portal and grant it access to the subscription. Then create the handler in CMP using that application’s credentials. To manage more than one subscription, see Azure resource handler for multiple cloud subscriptions.

Before you begin

Prepare your Azure portal for CMP integration.

1. Log in to your Azure portal.
2. Go to Subscriptions.
3. Take note of the Subscription ID.
4. Create and register a Microsoft Entra ID application that can access resources.
5. Take note of the application’s Application ID, secret, and Directory ID. Refer to Microsoft’s documentation for assistance in locating these values.
6. Give the application a role on the subscription. Contributor covers everything CMP does; see Required Azure permissions for the read-only and least-privilege alternatives.
   1. Go to Subscriptions.
   2. Select the target subscription.
   3. Select Access control (IAM).
   4. Select Add, then the role you are assigning.
   5. Search for the application name, select it, and select Save.

Add an Azure resource handler

Create an Azure resource handler to connect CMP to your Azure subscription. The wizard presents two dialogs: the first collects the credentials, and the second names the handler and imports its regions.

1. Go to Admin > Resource Handlers.

2. Select Add.

3. Select Azure.

4. Complete the credentials fields, then select Continue.

   Field	Value
   Cloud Environment	The Azure cloud this subscription belongs to: Public (Default), Germany, China, or US Gov. Each sovereign cloud has its own regions and endpoints. You can change this later on an existing handler’s credentials form.
   Subscription ID	The ID of the subscription this handler manages.
   Application ID	The ID of the Microsoft Entra ID application you registered. Azure calls this the Client ID.
   Authentication Key	The secret created for that application. Azure displays the value only once, when it is generated. If the password vault feature is enabled, this field offers Locally Stored or Vault Managed. Select Vault Managed to read the key from a configured vault provider. See Use password vaults.
   Directory ID	The directory the application belongs to. Azure calls this the Tenant ID.

5. Complete the settings fields, then select Done. The following fields are specific to Azure:

   • Import locations lists every region available to the subscription. CMP creates one environment for each selected region, so select the regions you intend to provision into.
   • Split by region runs Azure sync jobs separately for each region rather than as a single job.
   • Azure Disk Name Template sets a parameterized name for disks added to a server, for example {{ server.hostname }}-00X. Leave it empty to use the default naming.

Required Azure permissions

Contributor on the subscription covers everything CMP does. To grant less than Contributor, either for a read-only setup or as a least-privilege custom role, see Required Azure permissions.

Tag Azure resources

CMP applies a server’s tags to each Azure resource it creates during server provisioning and synchronizes tags across the servers it manages. Depending on the order, the resources tagged at provision time can include the virtual machine, its network interface, the OS disk, any additional disks, an availability set, a resource group, a storage account, and a public IP address.

Tags reach a resource group only when CMP creates it. Selecting an existing resource group on the order form leaves that group’s tags untouched.

The handler’s Tags tab lists the server attributes available to use as tag values. For how tagging works across CMP, see Tags.