Azure

Connect Azure to inventory every Azure OpenAI deployment, AI Foundry project, Cognitive Services account, and AI-tagged App Service running in your subscription. Azure offers two connect paths: one-click Entra ID OAuth (sign in with a Reader account) or a headless service principal (register an app, grant it Reader, and paste its details). The connector polls Azure Resource Manager + Activity Logs + Monitor on a 15-minute cadence.

What gets observed

Azure OpenAI deployments — endpoint inventory + per-deployment token + request metrics from Monitor.
AI Foundry / Azure ML projects + endpoints.
Cognitive Services accounts (Speech, Language, Document Intelligence) and their key rotations.
App Services + Container Apps + Functions tagged as AI workloads.
Activity Log events on the above resources (creation, deletion, key regeneration).
Azure AD app + service-principal inventory touching AI scopes.

Azure OpenAI prompt + completion content does not flow through Activity Logs. For per-prompt fidelity, route your Azure OpenAI client through the collector LLM proxy or install the Python SDK. See also the dedicated Azure OpenAI walkthrough.

Setup

# Azure offers two connect paths in the dashboard — pick one.

# Path A — OAuth (fastest):
#   Click Connect and sign in with an Entra ID account that has Reader on
#   the subscription. Trefur requests the Azure Resource Manager
#   user_impersonation + offline_access scopes (shown on the consent
#   screen) and stores the refresh token. No app registration needed.

# Path B — Service principal (headless):
#
# 1. Register an app / service principal in Entra ID:
#    az ad sp create-for-rbac --name "Trefur Observe" \
#      --role "Reader" --scopes /subscriptions/<your-subscription-id>
#    Output gives appId (client_id), password (client_secret), tenant (tenant_id).
#
# 2. (Optional, for telemetry) also grant it Monitoring Reader on the
#    subscription and Log Analytics Reader on your workspace:
#    az role assignment create --role "Monitoring Reader" \
#      --assignee <appId> --scope /subscriptions/<subscription-id>
#
# 3. In Settings → Integrations → Azure choose "Service principal" and
#    fill the six fields:
#      - AAD tenant ID
#      - Subscription ID
#      - Resource group               (the RG hosting your AI Foundry workspace)
#      - AI Foundry workspace          (workspace name)
#      - Service-principal client ID
#      - Service-principal client secret
#    (Optional) Log Analytics workspace ID — required to pull KQL telemetry;
#    leave blank for ARM-inventory-only mode.

Access requested

On the OAuth path, the consent screen requests the Azure Resource Manager user_impersonation scope plus offline_access — Trefur acts with the signing-in account's existing Azure RBAC, so grant that account (or the service principal) the roles below.

Role	What it grants
`Reader`	List + describe all resources in the subscription (inventory baseline — required).
`Monitoring Reader`	Read Azure Monitor metrics + Activity Log entries for telemetry.
`Log Analytics Reader`	Optional — needed only to pull KQL telemetry from the Log Analytics workspace you supply.

Multi-subscription tenants

Assign the roles above at the management-group level instead of per-subscription, then connect once. Trefur enumerates the subscriptions the account (or service principal) can read and inventories each.

Troubleshooting

Symptom	Fix
`AuthorizationFailed` on resource list.	Confirm the service principal has Reader on the subscription. If access was just granted, role propagation can take up to 5 minutes.
Azure OpenAI metrics empty.	Some Azure OpenAI metrics require diagnostic settings to be enabled on each deployment. Toggle Diagnostic settings → Send to Log Analytics for each Azure OpenAI account.
Client secret expired.	App-registration secrets default to a 1- or 2-year lifetime. Trefur alerts 14 days before expiry — generate a new secret in Entra ID and paste it into the dashboard to rotate.

Back to all integrations.