Connector · Azure

Azure Cloud Connect

Connect an Azure subscription. Discovery uses read-only Azure Resource Manager calls only — it never creates or changes a resource — to inventory resources, API Management APIs and App Service / Function endpoints, then runs the posture checks.

Connect to Azure

Service principal with a read-only Reader role.

Azure AD tenant ID
Subscription ID
Client ID (service principal)
Region
Key Vault URL
Secret name
The SP client secret lives in your Key Vault — never in the box. At discovery the appliance reads it from the vault above using its own managed identity (grant it Key Vault Secrets User), uses it for that call, then discards it. Without vault access it returns the labelled synthetic catalogue.

Discovery result

No discovery run yet. Connect a subscription to inventory it.

What gets inventoried
Resources

All resources in the subscription (ARM /resources).

APIM APIs

APIs published on API Management services.

App Service / Functions

Web app and function endpoints — assessed by the posture checks.