Skip to main content

​
What Cymph uses it for

The Azure integration discovers cloud resources and Entra ID identities and imports them as Cymph assets. See Asset actions. All operations are read-only. Every call Cymph makes to Azure is an HTTP GET; the only POST is the OAuth token request to Entra ID. No resource, role assignment, or directory object is ever created, modified, or deleted. Azure is an asset source only — playbooks cannot be deployed to it, and it is not a content source for playbook import.

​
Requirements

Integrating with Azure requires the registration of an application in Microsoft Entra ID. You can see the detailed documentation here. There is no subscription field — Cymph enumerates every subscription the app registration can see and discovers resources across all of them.

​
Permissions

Cymph requests tokens using the .default scope, which means it asks for no scopes of its own: the access it gets is exactly the set of application permissions already consented on your app registration, plus whatever Azure RBAC roles its service principal has been assigned. You control access entirely from the Azure side. Two grants are needed, for two different APIs.

​
Azure Resource Manager — Reader

Assign the app’s service principal the Reader role on each subscription you want discovered: open the subscription → Access control (IAM) → Add role assignment → Reader. Reader covers every resource call Cymph makes. A subscription with no role assignment is silently skipped — it will not appear during discovery.

​
Microsoft Graph — directory read

Cymph reads users, groups, and service principals from Entra ID and imports them as identity assets. Grant one of the following as application permissions with admin consent:
Earlier versions of this page listed Sites.Read.All as an Azure requirement. It is not needed — the Azure connector makes no SharePoint calls. If you want to read SharePoint content, configure the separate SharePoint integration.
If you do not want to grant directory permissions at all, the integration still works for infrastructure resources — only the identity asset types (users, groups, service principals, managed identities) will come back empty.

​
What Cymph reads

​
Azure Resource Manager

​
Microsoft Graph

Cymph requests a fixed field selection rather than whole objects — for users, for example, it reads only display name, UPN, mail, job title, department, account status, and creation date.

​
Testing the connection

Test Connection acquires a token from Entra ID and reports:
Test Connection only verifies that the credentials are valid — it acquires a token and stops there. It does not check that the Reader role or the Graph permissions have been granted. An integration can test successfully and still discover nothing, which is almost always a missing Reader assignment or missing admin consent.