> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure

> Discover Azure resources and Entra ID identities, and import them as Cymph assets.

## What Cymph uses it for

The Azure integration discovers cloud resources and Entra ID identities and imports them as Cymph assets. See [Asset actions](/howto/asset_actions).

All operations are **read-only**. Every call Cymph makes to Azure is an HTTP `GET`; the only `POST` is the OAuth token request to Entra ID. No resource, role assignment, or directory object is ever created, modified, or deleted.

Azure is an asset source only — playbooks cannot be deployed to it, and it is not a content source for playbook import.

## Requirements

Integrating with Azure requires the registration of an application in Microsoft Entra ID. You can see the detailed documentation [here](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app).

| Field | Description |
| - | - |
| **Tenant ID** | Your Entra ID (Azure AD) tenant ID |
| **Client ID** | Application (client) ID of the registered application |
| **Client secret** | A client secret generated for the registered application |

There is no subscription field — Cymph enumerates every subscription the app registration can see and discovers resources across all of them.

## Permissions

Cymph requests tokens using the **`.default`** scope, which means it asks for no scopes of its own: the access it gets is exactly the set of **application permissions already consented on your app registration**, plus whatever **Azure RBAC** roles its service principal has been assigned. You control access entirely from the Azure side.

Two grants are needed, for two different APIs.

### Azure Resource Manager — Reader

Assign the app's service principal the **Reader** role on each subscription you want discovered: open the subscription → **Access control (IAM)** → **Add role assignment** → **Reader**.

Reader covers every resource call Cymph makes. A subscription with no role assignment is silently skipped — it will not appear during discovery.

<Note>
  This is also why a subscription can be missing from the **Import Scope** picker when you configure a sync. Cymph can only offer subscriptions the service principal can see, so a missing one is an Azure RBAC assignment to add, not a Cymph setting to change.
</Note>

### Microsoft Graph — directory read

Cymph reads users, groups, and service principals from Entra ID and imports them as identity assets. Grant **one** of the following as **application** permissions with admin consent:

| Option | Permissions | Notes |
| - | - | - |
| Simplest | `Directory.Read.All` | Single grant covering all four endpoints Cymph calls |
| Least privilege | `User.Read.All`, `Group.Read.All`, `Application.Read.All` | Narrower, but `Directory.Read.All` is still required for the `directoryObjects/getByIds` lookup used to resolve role-assignment principals |

<Note>
  Earlier versions of this page listed `Sites.Read.All` as an Azure requirement. It is **not** needed — the Azure connector makes no SharePoint calls. If you want to read SharePoint content, configure the separate [SharePoint](/integrations/content/sharepoint) integration.
</Note>

<Tip>
  If you do not want to grant directory permissions at all, the integration still works for infrastructure resources — only the identity asset types (users, groups, service principals, managed identities) will come back empty.
</Tip>

## What Cymph reads

### Azure Resource Manager

| Purpose | Resource provider |
| - | - |
| Enumerate subscriptions | `Microsoft.Resources/subscriptions` |
| Virtual machines and scale sets | `Microsoft.Compute/virtualMachines`, `virtualMachineScaleSets` |
| Network interfaces and public IPs (VM addressing) | `Microsoft.Network/networkInterfaces` |
| Load balancers and application gateways | `Microsoft.Network/loadBalancers`, `applicationGateways` |
| App Service, Container Apps, Spring Apps | `Microsoft.Web/sites`, `Microsoft.App`, `Microsoft.AppPlatform` |
| Kubernetes and OpenShift clusters | `Microsoft.ContainerService` |
| Logic Apps and their workflows | `Microsoft.Logic/workflows` |
| SQL, PostgreSQL, MySQL, Cosmos DB, Mongo clusters | `Microsoft.Sql`, `Microsoft.DBforPostgreSQL`, `Microsoft.DBforMySQL`, `Microsoft.DocumentDB` |
| Redis caches | `Microsoft.Cache` |
| Key vaults and storage accounts | `Microsoft.KeyVault`, `Microsoft.Storage` |
| Bare-metal instances | `Microsoft.BareMetalInfrastructure` |
| Role assignments | `Microsoft.Authorization/roleAssignments` |
| Activity log entries | `microsoft.insights/eventtypes/management` |

### Microsoft Graph

| Purpose | Graph endpoint |
| - | - |
| Users | `/v1.0/users` |
| Groups | `/v1.0/groups` |
| Service principals and managed identities | `/v1.0/servicePrincipals` |
| Resolve role-assignment principals to names | `/v1.0/directoryObjects/getByIds` |

Cymph requests a fixed field selection rather than whole objects — for users, for example, it reads only display name, UPN, mail, job title, department, account status, and creation date.

## Limits

| Limit | Value |
| - | - |
| Request timeout | 5 seconds |
| Resource Manager listing | Up to 200 pages per resource type |
| Graph page size | 999 objects |

## Keeping assets current

A one-off import reads your subscriptions once. To keep the imported resources up to date, create a sync and give it a schedule — see [Create a sync](/synchronizer/create-a-sync). An Azure sync can be narrowed to particular subscriptions, and picks up subscriptions you add later without being edited.

## Testing the connection

**Test Connection** acquires a token from Entra ID and reports:

| Message | Meaning |
| - | - |
| **Valid Azure credentials** | Entra ID issued a token for the tenant, client ID, and secret |
| **Connection timed out** | No response within 5 seconds |
| **Target does not seem to be a Azure Instance** | The token request failed for a reason other than a timeout |

<Warning>
  Test Connection only verifies that the **credentials** are valid — it acquires a token and stops there. It does **not** check that the Reader role or the Graph permissions have been granted. An integration can test successfully and still discover nothing, which is almost always a missing Reader assignment or missing admin consent.
</Warning>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.