Connect an Azure subscription

This page describes the service principal to create so that an Azure subscription is inventoried, the roles to grant depending on what you want analysed, and what the collector reads.

What you need

A service principal (an app registration in Entra ID) and four values: the "Tenant ID", the "Client ID (App ID)", a "Client Secret" created under "Certificates & secrets", and the "Subscription ID" of the subscription to analyse. One Ctadel account corresponds to one subscription; the same service principal may serve several accounts.

The credentials are not checked when the account is saved. The dialog's "Discover subscriptions" button tests them: Ctadel requests a token from the tenant and lists the visible subscriptions; a refused key returns Azure's error.

Roles to grant

Inventory

At subscription level:

Role	What it gives
Reader	The inventory through Azure Resource Manager: compute, network, storage, databases, AKS, Key Vault, role assignments, activity log. No write.
Log Analytics Reader	Diagnostic settings and log queries.

Content analyses

Each analysis needs a separate permission; without it, that analysis is absent and the rest works.

Analysis	Permission to grant	What Ctadel does
Blob content (secrets, sensitive data)	Storage Blob Data Reader on the storage accounts.	Ctadel requests an Entra ID token for https://storage.azure.com/ and reads the objects. It does not call listKeys: that operation would hand out a read-write account key, and it is refused on accounts where shared keys are disabled.
Virtual machine disks	Write permissions beyond Reader: managed disk snapshots, creation of a resource group, a virtual network and a virtual machine.	Ctadel creates a ctadel-scan-<region> resource group with its network, snapshots the disk, mounts it on a temporary scanner machine in your subscription, then deletes everything.
Function App code and settings	A custom role with Microsoft.Web/sites/config/list/action and Microsoft.Web/sites/publish/action; AcrPull on the registry for containerised functions.	Reads the code from the SCM site and the authentication level. Without these actions the function is reported as not read, never as "clean".
AKS cluster objects	The Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action action on the clusters.	Ctadel fetches the cluster's admin kubeconfig through the ARM API and reads the Kubernetes objects with it. AKS posture read through ARM does not depend on it.

Entra ID

Users, service principals and tenant settings are read through Microsoft Graph, with application permissions and admin consent:

Graph permission	What it provides
Application.Read.All	Service principals, secrets and certificates of app registrations.
User.Read.All	Entra ID users.
Directory.Read.All	Privileged directory roles and their members; without it, a user's "administrator" property stays unknown instead of "false". Also Entra groups and their members, and the enterprise applications each user is assigned to.
Policy.Read.All	Authorization policy (guest rights, app registration) and conditional access.
AuditLog.Read.All	Users' last sign-in; also needs a P1 or P2 licence.
Reports.Read.All	Users' MFA registration state.
AccessReview.Read.All	Guest access reviews; needs a P2 licence.

A missing permission leaves the corresponding property unset, never false.

Declaring the subscription in Ctadel

1. Open "Settings", tab "Integrations", sub-tab "Cloud Providers", then "Add account" on the Microsoft Azure row.
2. Enter a "Label", then "Tenant ID", "Client ID (App ID)", "Client Secret" and "Subscription ID".
3. Click "Discover Subscriptions": Ctadel obtains a token and lists the subscriptions visible to the service principal, flagging those that are not active.
4. Click "Create", or "Add the N accounts" to create one account per discovered subscription.

What the collector reads

Family	Resources read
Subscription and tenant	Subscription posture, tenant Entra ID settings, role assignments, Defender for Cloud plans and security contact, diagnostic settings, activity log alerts.
Identities	Entra ID users (on-premises sync, last sign-in, password age, MFA, privileged roles), service principals and their secrets.
Compute	Virtual machines, disks and snapshots, AKS clusters and their node pools, Function Apps, App Service, Logic Apps, container registries.
Network	Virtual networks, network security groups, public IP addresses, load balancers, gateways, network interfaces, private endpoints, Application Gateway, Azure Firewall, Front Door, DNS zones, API Management.
Data	Storage accounts and their posture, SQL servers and databases, PostgreSQL flexible, Cosmos DB, Redis, Synapse, Data Factory, HDInsight, Event Hubs, Service Bus, App Configuration, Recovery Services vaults.
Secrets and keys	Key Vault and Managed HSM.
AI	Cognitive services, including Azure OpenAI.

Subscriptions in the "Warned" or "PastDue" state are read like active ones; those in the "Disabled" or "Deleted" state are not.

When a resource type could not be fully read, the resources of that type already known stay in the inventory and are not treated as deleted.

Limitations

• The content of Azure SQL databases is not analysed: only their posture (public access, encryption, auditing) is read. A content analysis that never touches the production server is under study.
• A Function App's authentication level stays unknown without Microsoft.Web/sites/config/list/action. Application settings are not downloaded.
• Listing the keys and secrets of a Key Vault needs data-plane access to the vault; without it, the corresponding property stays unknown.
• Entra ID properties (last sign-in, MFA, access reviews) depend on the Graph permissions and licences listed above.
• Access to AKS objects goes through the cluster's admin kubeconfig, not through a read-only identity.
• Detection on the Azure activity log is under internal validation, not available to customers.
• Credentials are only checked if you click "Discover subscriptions"; otherwise, an error (wrong or expired secret, removed role) shows in the account's state at the first scan.