Docs / Onboarding / Azure

Onboard Microsoft Azure

Create an Entra app for CloudPulse, grant management-group Reader (and optional billing), then register the account in CloudPulse with federation — no client secret in production.

Prerequisites

• Entra ID permissions to create an app registration / service principal.
• Management Group Name/Id (GUID or id string — not only the display name).
• CloudPulse tenant admin or editor access at app.cloudpulse.host.

Steps

1. Open Accounts → Add Azure. Enter a display name. Note the federation values shown when CloudPulse workers use managed identity (issuer / subject). Leave Billing fields blank if you will configure them later.
2. Download the setup script from the Accounts form (cloudpulse-azure-customer-setup.ps1). Run it in PowerShell as a user who can create the app and assign RBAC on the management group. The script is idempotent: it reuses an existing app by AppId/name when present.
3. Confirm RBAC. Typical grants: Reader on the management group; Cost Management Reader where needed; optional Billing Account / Billing Profile roles for invoices and Cost Management exports; Storage Blob Data Reader on export storage when you enable billing export.
4. Register in CloudPulse. Paste:
   • Entra tenant ID
   • App (client) ID
   • Management Group ID (the Name/Id from the portal or script output)
   Production: federated credential only — do not paste a client secret.
5. Optional billing. On the Billing tab, use Discover exports or paste container/path for Cost Management ActualCost exports. Billing scope is often a billing account, not the management group alone.
6. Verify. Once data is available, open Azure Insights tabs (inventory, cost, security). Empty tabs usually mean sync has not finished yet or a role is missing — contact CloudPulse support rather than storing secrets.

You vs CloudPulse support

API (automation)

Authenticated admins can download the same script:

GET /v1/accounts/azure-setup-script?...
GET /v1/accounts/{account_id}/azure-setup-script

Create/update accounts via /v1/accounts/ (see API reference). Production rejects long-lived azure_client_secret.