> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure

> Discover Azure resources and Entra ID identities, and import them as Cymph assets.

## What Cymph uses it for

The Azure integration discovers cloud resources and Entra ID identities and imports them as Cymph assets. See [Asset actions](/howto/asset_actions).

All operations are **read-only**. Every call Cymph makes to Azure is an HTTP `GET`; the only `POST` is the OAuth token request to Entra ID. No resource, role assignment, or directory object is ever created, modified, or deleted.

Azure is an asset source only — playbooks cannot be deployed to it, and it is not a content source for playbook import.

## Requirements

Integrating with Azure requires the registration of an application in Microsoft Entra ID. You can see the detailed documentation [here](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app).

| Field             | Description                                              |
| ----------------- | -------------------------------------------------------- |
| **Tenant ID**     | Your Entra ID (Azure AD) tenant ID                       |
| **Client ID**     | Application (client) ID of the registered application    |
| **Client secret** | A client secret generated for the registered application |

There is no subscription field — Cymph enumerates every subscription the app registration can see and discovers resources across all of them.

## Permissions

Cymph requests tokens using the **`.default`** scope, which means it asks for no scopes of its own: the access it gets is exactly the set of **application permissions already consented on your app registration**, plus whatever **Azure RBAC** roles its service principal has been assigned. You control access entirely from the Azure side.

Two grants are needed, for two different APIs.

### Azure Resource Manager — Reader

Assign the app's service principal the **Reader** role on each subscription you want discovered: open the subscription → **Access control (IAM)** → **Add role assignment** → **Reader**.

Reader covers every resource call Cymph makes. A subscription with no role assignment is silently skipped — it will not appear during discovery.

### Microsoft Graph — directory read

Cymph reads users, groups, and service principals from Entra ID and imports them as identity assets. Grant **one** of the following as **application** permissions with admin consent:

| Option          | Permissions                                               | Notes                                                                                                                                      |
| --------------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Simplest        | `Directory.Read.All`                                      | Single grant covering all four endpoints Cymph calls                                                                                       |
| Least privilege | `User.Read.All`, `Group.Read.All`, `Application.Read.All` | Narrower, but `Directory.Read.All` is still required for the `directoryObjects/getByIds` lookup used to resolve role-assignment principals |

<Note>
  Earlier versions of this page listed `Sites.Read.All` as an Azure requirement. It is **not** needed — the Azure connector makes no SharePoint calls. If you want to read SharePoint content, configure the separate [SharePoint](/integrations/content/sharepoint) integration.
</Note>

<Tip>
  If you do not want to grant directory permissions at all, the integration still works for infrastructure resources — only the identity asset types (users, groups, service principals, managed identities) will come back empty.
</Tip>

## What Cymph reads

### Azure Resource Manager

| Purpose                                           | Resource provider                                                                            |
| ------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| Enumerate subscriptions                           | `Microsoft.Resources/subscriptions`                                                          |
| Virtual machines and scale sets                   | `Microsoft.Compute/virtualMachines`, `virtualMachineScaleSets`                               |
| Network interfaces and public IPs (VM addressing) | `Microsoft.Network/networkInterfaces`                                                        |
| Load balancers and application gateways           | `Microsoft.Network/loadBalancers`, `applicationGateways`                                     |
| App Service, Container Apps, Spring Apps          | `Microsoft.Web/sites`, `Microsoft.App`, `Microsoft.AppPlatform`                              |
| Kubernetes and OpenShift clusters                 | `Microsoft.ContainerService`                                                                 |
| Logic Apps and their workflows                    | `Microsoft.Logic/workflows`                                                                  |
| SQL, PostgreSQL, MySQL, Cosmos DB, Mongo clusters | `Microsoft.Sql`, `Microsoft.DBforPostgreSQL`, `Microsoft.DBforMySQL`, `Microsoft.DocumentDB` |
| Redis caches                                      | `Microsoft.Cache`                                                                            |
| Key vaults and storage accounts                   | `Microsoft.KeyVault`, `Microsoft.Storage`                                                    |
| Bare-metal instances                              | `Microsoft.BareMetalInfrastructure`                                                          |
| Role assignments                                  | `Microsoft.Authorization/roleAssignments`                                                    |
| Activity log entries                              | `microsoft.insights/eventtypes/management`                                                   |

### Microsoft Graph

| Purpose                                     | Graph endpoint                    |
| ------------------------------------------- | --------------------------------- |
| Users                                       | `/v1.0/users`                     |
| Groups                                      | `/v1.0/groups`                    |
| Service principals and managed identities   | `/v1.0/servicePrincipals`         |
| Resolve role-assignment principals to names | `/v1.0/directoryObjects/getByIds` |

Cymph requests a fixed field selection rather than whole objects — for users, for example, it reads only display name, UPN, mail, job title, department, account status, and creation date.

## Testing the connection

**Test Connection** acquires a token from Entra ID and reports:

| Message                                         | Meaning                                                       |
| ----------------------------------------------- | ------------------------------------------------------------- |
| **Valid Azure credentials**                     | Entra ID issued a token for the tenant, client ID, and secret |
| **Connection timed out**                        | No response within 5 seconds                                  |
| **Target does not seem to be a Azure Instance** | The token request failed for a reason other than a timeout    |

<Warning>
  Test Connection only verifies that the **credentials** are valid — it acquires a token and stops there. It does **not** check that the Reader role or the Graph permissions have been granted. An integration can test successfully and still discover nothing, which is almost always a missing Reader assignment or missing admin consent.
</Warning>