Connect Azure

This guide walks you through creating an App Registration in Microsoft Entra ID (formerly Azure AD) and granting it the permissions Troposphere needs to read your cost, resource, and identity data.

What Troposphere reads#

Troposphere uses the App Registration to read two categories of data:

• Subscription data via Azure Resource Manager – resource inventory (Resource Graph), resource details, role assignments and definitions (Authorization), and cost reports (Cost Management).
• Directory data via Microsoft Graph – users, groups, and service principals in your Entra ID tenant, used to resolve principal identities on role assignments.

Troposphere never writes to your tenant or subscriptions. All required permissions are read-only.

Prerequisites#

• Permission to create an App Registration and grant admin consent for Microsoft Graph application permissions in your Entra ID tenant – typically the Global Administrator or Privileged Role Administrator role.
• Permission to assign RBAC roles (Owner or User Access Administrator) on each subscription you want to connect, or on a Management Group that contains them.
• At least one active Azure subscription.

Step 1: Create an App Registration#

1. In the Azure portal, navigate to Microsoft Entra ID > App registrations.
2. Click New registration. Enter a name such as troposphere-reader and leave the redirect URI blank.
3. After creation, note the Application (client) ID and Directory (tenant) ID from the overview page.
4. Under Certificates & secrets, create a new client secret. Copy the secret value immediately – it will not be shown again.

Step 2: Grant Microsoft Graph permissions#

Troposphere reads directory data (users, groups, service principals) from Microsoft Graph. These permissions must be granted on the App Registration itself and consented by an admin.

1. On the App Registration, go to API permissions > Add a permission.
2. Select Microsoft Graph > Application permissions.
3. Add Directory.Read.All. This single permission covers every directory read Troposphere performs.
4. Back on the API permissions page, click Grant admin consent for [tenant]. The status for Directory.Read.All should change to Granted.

Step 3: Assign subscription roles and capture the Subscription ID#

Each Troposphere connection is scoped to a single Azure subscription, so repeat this step for every subscription you want to monitor – creating a separate connection in Troposphere for each.

1. Navigate to Subscriptions > [your subscription].
2. On the Overview page, copy the Subscription ID – you will need it in Step 4.
3. Open Access control (IAM) for the subscription.
4. Click Add > Add role assignment and assign the Reader role to the App Registration. This single role covers every subscription-scope read Troposphere performs: resource inventory, resource details, role assignments, role definitions, and cost reports.

Step 4: Enter credentials in Troposphere#

1. In Troposphere, go to Inventory > Connections and click Add Connection.
2. Select Azure as the provider.
3. Enter the Tenant ID, Subscription ID, Client ID, and Client Secret you collected in the previous steps.
4. Click Save. Troposphere will validate the credentials and begin importing data. Resource inventory and directory data usually appear within a few minutes; the first cost report may take longer depending on the size of the subscription.

Troubleshooting#

Verifying a healthy connection#

A working connection should progress through the following connection states on the Inventory > Connections page:

1. Pending – immediately after creation, before the first sync.
2. Importing – the first sync is running.
3. Active – the last sync succeeded and there are no open alerts on the connection.

Resources, principals, role assignments, and the first cost figures should all appear within a few minutes after the connection reaches the Active state.

Connection stays in “Failed” state#

The connection status goes to Failed when the last import could not complete, usually due to authentication or permissions issues.

Symptom – authentication error immediately after saving the connection. One of the four credential fields is wrong. Double-check the exact values of:

• Tenant ID – copied from the Microsoft Entra ID overview.
• Subscription ID – copied from the Subscription’s overview page. A common mistake is to copy the Subscription name instead.
• Client ID (Application ID) – copied from the App Registration’s overview.
• Client Secret – the secret value, not the secret ID. Client secrets are only shown once at creation; if lost, generate a new one and paste that.

Symptom – the connection authenticates but cannot list resources. The App Registration is missing the Reader role on the subscription (or the Management Group above it). On the subscription’s Access control (IAM) page, assign the Reader role to the App Registration.

Identity & Access sections are empty#

Resources and costs appear, but Identity & Access > Principals shows zero users/groups/service accounts and Role Assignments is empty. Microsoft Graph application permissions were never granted, or admin consent was not completed.

On the App Registration’s API permissions page, verify that Microsoft Graph > Application permissions includes either Directory.Read.All or the three narrower permissions (User.Read.All, Group.Read.All, Application.Read.All). The status column must show Granted for [tenant] – if it says “Not granted”, click Grant admin consent for [tenant].

If the grant button is disabled, your Entra ID role (such as Application Administrator alone) may not have permission to grant admin consent. Ask a Global Administrator or Privileged Role Administrator to perform the consent step.

Role assignments are missing for some principals#

Principals appear on the page but their role assignments look incomplete. Troposphere only sees role assignments on subscriptions it has been granted Reader on – assignments on subscriptions you have not connected to Troposphere are invisible. Connect every subscription you want visibility into, or assign the App Registration’s Reader role at the Management Group level to cover all child subscriptions at once.

The connection works, then fails months later#

Client secrets expire. The default lifetime for an App Registration client secret is 6, 12, or 24 months depending on how it was created. On the App Registration’s Certificates & secrets page, create a new client secret, copy its value, then open the connection in Troposphere and paste the new secret into the Client Secret field.

Still stuck?#

Check the connection’s detail page in Troposphere (Inventory > Connections > [your connection]). Any open alerts on the connection will describe the specific failure seen on the last import – this is the most reliable starting point for any issue not covered above.