Azure

Connecting your Azure subscription to Cloud2Gether allows the platform to discover and analyze your cloud resources, costs, and infrastructure. Cloud2Gether requires read-only access to your Azure subscription — it will never create, modify, or delete any resources.

The integration uses Microsoft Entra ID (Azure AD) App Registration with a client secret to authenticate. A service principal is created automatically when you register the app, and you assign it read-only roles on your subscription.

Prerequisites

Before you begin, make sure you have:

• An active Azure subscription
• Access to Azure Portal with permissions to:
  • Register applications in Microsoft Entra ID (Azure AD)
  • Assign roles on the target subscription (requires Owner or User Access Administrator role)
• A Cloud2Gether account — sign up here if you don’t have one

Information You Will Need

At the end of this setup, you will have collected four values to enter in Cloud2Gether:

Part 1 — Azure Configuration

Step 1 — Register an Application in Microsoft Entra ID

An App Registration creates an identity that Cloud2Gether uses to authenticate with your Azure environment.

1. Sign in to the Azure Portal
2. Navigate to Microsoft Entra ID (formerly Azure Active Directory)
3. In the left sidebar, click App registrations
4. Click + New registration

5. Fill in the registration form:
   • Name: Enter a descriptive name, for example: Cloud2Gether Integration
   • Supported account types: Select Accounts in this organizational directory only (Single tenant)
   • Redirect URI: Leave blank (not required)
6. Click Register

After registration, you will be taken to the application’s Overview page. Copy the following values:

• Application (client) ID — this is your Client ID
• Directory (tenant) ID — this is your Tenant ID

Step 2 — Create a Client Secret

A client secret is a password that Cloud2Gether uses to authenticate as the registered application.

1. In the App Registration page, click Certificates & secrets in the left sidebar
2. Select the Client secrets tab
3. Click + New client secret

4. Fill in the details:
   • Description: Enter a descriptive label, for example: Cloud2Gether secret
   • Expires: Choose an expiration period (recommended: 24 months)
5. Click Add

Store the Client Secret Value securely — you will need it when connecting in Cloud2Gether.

Step 3 — Assign Roles to the Application

The application’s service principal needs read-only access to your Azure subscription. You must assign two roles:

Assign the Reader Role

1. In the Azure Portal, navigate to Subscriptions
2. Select the subscription you want to connect to Cloud2Gether
3. Click Access control (IAM) in the left sidebar
4. Click + Add → Add role assignment

5. In the Role tab, search for Reader and select the Reader role
6. Click Next
7. In the Members tab:
   • Select User, group, or service principal
   • Click + Select members
   • Search for your application name (e.g., Cloud2Gether Integration)
   • Select the application and click Select
8. Click Review + assign

Assign the Monitoring Data Reader Role

Repeat the same process for the Monitoring Data Reader role:

1. In the same subscription’s Access control (IAM), click + Add → Add role assignment
2. Search for Monitoring Data Reader and select it
3. Click Next
4. In the Members tab, select the same application (Cloud2Gether Integration)
5. Click Review + assign

Verify Role Assignments

1. In Access control (IAM), click the Role assignments tab
2. Confirm that your application appears with both roles:
   • Reader
   • Monitoring Data Reader

Step 4 — Copy Your Subscription ID

1. Navigate to Subscriptions in the Azure Portal
2. Click on the subscription you assigned the roles to
3. Copy the Subscription ID from the Overview page

Part 2 — Cloud2Gether Setup

Step 5 — Connect in Cloud2Gether

1. Log in to Cloud2Gether
2. In the left sidebar, click Cloud Accounts
3. Click the Add Account button
4. Select Azure as the cloud provider

Step 6 — Enter Account Information

1. Account Name

Enter a logical name to identify this Azure subscription inside Cloud2Gether.

Examples:

• Azure Production
• Azure Dev/Test
• Finance Subscription

2. Azure Credentials

Enter the four values you collected during the Azure configuration:

Step 7 — Add the Account

1. Click Add Account
2. Cloud2Gether will validate:
   • Credential authenticity
   • Role assignments and permissions
   • Subscription accessibility

If successful, the account will appear in your Cloud Accounts list.

Troubleshooting

Invalid Credentials

• Verify the Tenant ID, Client ID, and Client Secret are correct
• Confirm the client secret has not expired
• Ensure no leading or trailing whitespace in the pasted values
• Make sure you copied the secret Value (not the Secret ID)

Insufficient Permissions

• Verify both Reader and Monitoring Data Reader roles are assigned on the subscription
• Confirm the roles are assigned to the correct service principal (the app registration name)
• Check that the role assignments are at the subscription level, not a resource group

Application Not Found

• Ensure the App Registration exists and has not been deleted
• Verify you are using the correct Tenant ID for the directory where the app was registered

Expired Client Secret

• Client secrets have an expiration date. If your secret has expired:
  1. Go to the App Registration → Certificates & secrets
  2. Create a new client secret
  3. Update the secret in Cloud2Gether’s Cloud Accounts settings

Security Best Practices

• Use the minimum required roles (Reader + Monitoring Data Reader)
• Set a reasonable secret expiration and rotate before it expires
• Avoid granting Contributor or Owner roles — Cloud2Gether only needs read access
• Use dedicated App Registrations for third-party integrations instead of reusing existing ones
• Monitor sign-in activity for the service principal in Microsoft Entra ID → Enterprise applications → Sign-in logs
• Consider using Conditional Access policies to restrict where the service principal can authenticate from

Next Steps

After successful integration, you can:

• Explore your resources in the Resource Catalog
• Analyze infrastructure costs
• Run lock-in analysis across your multi-cloud environment
• Set up additional cloud accounts (AWS, GCP) for a unified view