Docs: Create Azure Account

Mon, 01 Jan 0001 00:00:00 +0000

Procedure

On the Cloud Accounts page, click “Create” above the list to open the create cloud account page.
Select Azure as the cloud platform, then click “Next: Configure cloud account”.
Configure the following parameters:
- Name: Azure account name.
- Account type: Currently supports connecting Azure Global, China, US Government, and Germany region accounts.
- Tenant ID / Client ID / Client secret: see How to obtain Azure parameters.
- Common parameters: see Common configuration parameters.
Click “Connection test” to verify that the parameters are correct.
After a successful test, click “Next: Configure sync regions” to configure resource sync regions (all regions are synced by default).
After configuration, click “Next: Billing file access information (optional)” to configure billing parameters.
Configure scheduled sync (optional), then click “OK” to create the Azure account.

Enable passwordless login: When enabled, the system becomes an identity provider for cloud login, enabling single sign-on from this system to the public cloud platform. Passwordless login is currently supported only for Azure Global; this option is shown only when the account type is Global.

How to obtain Azure parameters

Obtain Azure Tenant ID and Client information

Sign in to the Azure portal, search for and open “Microsoft Entra ID” (formerly Azure Active Directory), click “App registrations” in the left navigation, and open the app registrations page. Creating a dedicated application for the cloud management platform to call Azure APIs is recommended.

Click “New registration”. On the register an application page, set any name, set supported account types to “Accounts in this organizational directory only – Default Directory”, then click “Register”.

After creation succeeds, the system automatically opens the application details page. The Application (client) ID on this page is the required Client ID, and the Directory (tenant) ID is the required Tenant ID.

On the application details page, click “Certificates & secrets” to open the certificates and secrets page. Click “New client secret”.

In the add a client secret dialog, enter a description, select an expiration (up to 24 months), then click “Add” to create the client secret.

After saving succeeds, immediately copy the secret value shown on the page; this value is the required client secret.

Note: The client secret value is shown only once after creation and cannot be viewed again after you leave the page. Copy and store it securely immediately. After the secret expires, create a new one and update the Azure account configuration on the cloud management platform.

How to grant subscription permissions to the application

Sign in to the Azure portal, click “All services” in the left navigation, then select and click “Subscriptions” to open the subscriptions list.

Click the subscription to authorize to open the subscription details page.

Click “Access control (IAM)”. On the access control page, click “Add role assignment”.

On the “Role” tab, select “Owner”, then click “Next”. On the “Members” tab, assign access to “User, group, or service principal”, click “Select members”, search for the application name created in the previous step, select the application, click “Next”, then click “Review + assign”.

On the role assignments page, verify that subscription permissions have been granted to the application.

Application API permission settings

If you do not need to manage Azure users and groups, you can skip the following permissions.

Note: The Azure AD Graph API (graph.windows.net) is deprecated; use the Microsoft Graph API instead. On the application’s “API permissions” page, add Microsoft Graph application permissions.

Region	API permissions
Azure China	Directory.Read.All, Directory.ReadWrite.All, Domain.Read.All
Azure Global	Directory.Read.All, Directory.ReadWrite.All, Domain.Read.All, Domain.ReadWrite.All, Member.Read.Hidden, Policy.Read.All

Permission configuration

To manage Azure cloud resources, the cloud account needs the following permissions:

Permission description	Read-only	Read-write
Manage all resources	Reader	Owner
Manage virtual machine resources	-	Virtual Machine Contributor
Manage network resources	-	Network Contributor
Manage object storage	Storage Blob Data Reader	Storage Blob Data Owner
Manage cloud databases	Cloud SQL Viewer	Cloud SQL Admin
Manage Redis	Redis Enterprise Cloud Viewer	Redis Enterprise Cloud Admin
Manage file storage	Storage File Data SMB Share Reader	Storage File Data SMB Share Contributor
Manage resource policies and roles	-	Graph Owner, Resource Policy Contributor
Manage DNS	-	DNS Zone Contributor, Private DNS Zone Contributor
Manage billing and costs	Billing Reader, Cost Management Reader	Cost Management Contributor
Manage monitoring	Monitoring Reader	Monitoring Contributor

Billing configuration

Note: The Azure EA (Enterprise Agreement) reporting API has been fully retired. Configure a billing bucket (Cost Management export) or API billing sync instead. The EA account configuration below applies only where that method is still supported; prefer billing bucket configuration.

Billing bucket configuration

Cloud account type: Includes primary account and associated account
Bucket URL: URL of the bucket that stores billing files
File prefix: For Azure, the file prefix is the account ID
Billing analysis scope: Includes accounts onboarded on this platform and all accounts

API billing configuration

This method obtains billing data by calling the Azure Cost Management Generate Cost Details Report REST API. The application (service principal) must have Cost Management Reader or higher at the billing account level.

Configure billing API permissions

Sign in to the Azure portal, search for and open “Cost Management”.
On the Cost Management overview page, find and click your billing account.
On the billing account details page, click “Access control (IAM)” in the left menu to open the billing account access control page.
Click “Add” and select the “Billing account owner” role.

Note: You can also select “Billing account reader” (Cost Management Reader) or “Billing account contributor” (Cost Management Contributor). Following least privilege and using Cost Management Reader is recommended.
Wait a few minutes for permissions to take effect, then sync billing via the API.

EA account configuration (deprecated)

Note: The Azure EA reporting API has been fully retired. This method is for historical reference only. Use Billing bucket configuration to sync billing.

EA (Enterprise Agreement) account spending obtains billing information via enrollment number and key:

Enrollment number: Unique identifier associated with the online enterprise agreement, a number starting with V570
Key: API access key

How to obtain the Azure billing bucket

Click “Exports”, select a scope. Choose a group (root directory requires admin permissions) so that billing for all subscriptions in the group is merged into one file.

After selecting the group as scope, click “Create”, set export type to “Daily export of month-to-date costs”, and fill in other information as prompted.

After creation succeeds, you can manually trigger a billing job to ensure billing files exist in the billing bucket.

Find the storage account configured in the previous step and locate the corresponding billing bucket URL.

Click Containers, select the container specified in the billing job, then click the name to open details.

Click Properties to view the URL information.

How to obtain the Azure enrollment number and key (deprecated)

Note: The Azure EA reporting API has been fully retired. The following content is for historical reference only.

Sign in to the Azure China EA Portal or Azure EA Portal. After signing in, the number in the upper left is the enrollment number.

Click “Reports” in the left navigation, select the “Download usage > API Access Key” tab. The primary key on this page is the key.

Cloudpods – Azure