Skip to content

Azure integration

Connect DXDT to your Azure subscription(s) using a read-only Service Principal so DXDT can run read-only az CLI calls for SRE and FinOps insight. You register an App Registration, create a client secret, and assign it the Reader role.
Setup time ~20 minutes
Difficulty Advanced

Access required: Azure AD (Entra ID) permission to create an App Registration, and Owner/User Access Administrator on the subscription(s) to assign the Reader role.

Prerequisites

  • An Azure subscription (or several) you want DXDT to observe.
  • Rights to register an application in Microsoft Entra ID (Azure AD).
  • Rights to assign the built-in Reader role at the subscription scope.

Setup

1. Register an App (Service Principal)

In the Azure Portal → Microsoft Entra ID → App registrations → New registration, give it a name such as DXDT-ReadOnly and register it. On the overview page copy the Application (client) ID and the Directory (tenant) ID.

  • Application (client) ID -> client_id
  • Directory (tenant) ID -> azure_tenant_id

2. Create a client secret

In the app's Certificates & secrets → Client secrets → New client secret, set an expiry and create it. Copy the secret Value immediately (it is shown only once) — this is your client_secret.

3. Assign the Reader role

Go to Subscriptions → (your subscription) → Access control (IAM) → Add role assignment. Select the built-in Reader role, then assign it to the App Registration (Service Principal) you created. Copy the Subscription ID for subscription_id.

Note

Repeat this Reader assignment on every subscription you want DXDT to observe.

4. Enter the configuration in DXDT

Open the azure-exec plugin and paste azure_tenant_id, client_id, client_secret, and subscription_id. For multi-subscription observation, supply the subscriptions field mapping friendly names to per-subscription credential sets. DXDT logs in per-request via az login --service-principal and stores nothing on the stateless exec service.

  • Single subscription: fill azure_tenant_id, client_id, client_secret, subscription_id.
  • Multi-subscription: subscriptions = {"prod": {"client_id": "...", "client_secret": "...", "tenant_id": "...", "subscription_id": "..."}, "staging": {...}}.

Configuration fields

Field Where to find it
Directory (tenant) ID (azure_tenant_id) App registration overview → Directory (tenant) ID.
Application (client) ID (client_id) App registration overview → Application (client) ID.
Client secret value (client_secret) App registration → Certificates & secrets → the secret Value (copy at creation time).
Subscription ID (subscription_id) Subscriptions blade → the subscription you granted Reader on.
Subscriptions (multi-sub) (subscriptions) Optional map/list of friendly name → per-subscription credential set, for observing multiple subscriptions with one config.

Verify the connection

After saving, open the plugin Status view. A healthy connection lists the subscription(s) and confirms a successful az login --service-principal with Reader-level access.

Security

DXDT runs only read-only az CLI calls. Assign the least-privilege built-in Reader role — never Contributor or Owner. Set a secret expiry and rotate the client_secret per your policy; DXDT's exec service is stateless and stores no standing credentials.

Troubleshooting

AADSTS7000215: Invalid client secret provided

The client_secret is wrong or expired. Create a new client secret in Certificates & secrets and paste the new Value (not the secret ID).

az login succeeds but no resources are visible

The Service Principal has no role assignment on the subscription. Assign the built-in Reader role to the app at the subscription scope, then retry.

AADSTS700016: Application not found in the directory

Wrong azure_tenant_id or client_id. Re-copy both values from the App registration overview page and confirm you are in the correct tenant.

One subscription works but another returns empty

Reader was assigned on only one subscription, or a per-subscription entry in subscriptions is misconfigured. Assign Reader on each subscription and verify each entry's subscription_id and credentials in the subscriptions map.

Vendor documentation: https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal