Azure - ResolveAI

Connect from ResolveAI to Microsoft Azure to give the agent access to Azure Monitor logs and metrics, Application Insights telemetry, alerts, and Microsoft Entra sign-in and audit logs to be used in investigations. Access is read-only, and covers Azure Commercial Cloud only.

Prerequisites

In Microsoft Entra: Application Developer, Cloud Application Administrator, or Application Administrator, to create an app registration and add a client secret.
In Azure: Owner, User Access Administrator, or Role Based Access Control Administrator on each subscription or resource group you grant.

In Azure

1. Create an app registration

Open Microsoft Entra ID → App registrations → New registration.
Choose Accounts in this organizational directory only and leave the redirect URI empty.
From the app’s Overview page, copy the Directory (tenant) ID and the Application (client) ID.

2. Create a client secret

Go to Certificates & secrets → Client secrets → New client secret.
Copy the secret’s Value, not its Secret ID. It is shown only once.

3. Grant roles

On each subscription or resource group you want ResolveAI to read, open Access control (IAM) → Add → Add role assignment and assign the app the built-in read-only roles for the data you want:

Monitoring Reader: Azure Monitor metrics and alerts
Log Analytics Reader: log queries and Application Insights telemetry

Log Analytics workspaces are often in a different subscription from the resources that log into them. Grant Log Analytics Reader on the workspace subscription too, or log queries come back empty.

In ResolveAI

Two ways to connect, both using the app registration from steps 1 to 3.

Resolve UI
Resolve Satellite

ResolveAI connects directly to your Azure account.

4. Add an Azure connection

Open Integrations for your organization, click Azure, then Add Connection at the top right. Give the integration a name (ex. Azure Prod) and list its environments (ex. production and staging).

5. Add the app registration

Directory (tenant) ID and Application (client) ID: from step 1
Client Secret: the Value from step 2
Subscription IDs: the subscriptions you granted in step 3, from the Subscriptions page in the Azure portal

6. Add the optional scopes

Resource Groups: narrows reads to named groups in the first subscription. Set it when you granted the roles at resource-group scope.
Log Analytics workspace IDs: the workspaces to search, from each workspace’s Overview page, including any holding Microsoft Entra sign-in and audit logs.

7. Save and verify

Click Save, then verify the connection with Check Health.

The Resolve Satellite connects to Azure from inside your cluster, for Azure data behind a private network or when the client secret should not leave your environment. Only the tenant, client and subscription identifiers reach ResolveAI.

Prerequisite: the Resolve Satellite is already installed in your environment. See Resolve Satellite for installation instructions.

4. Create a Kubernetes secret

azure-credentials.yml

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: azure-credentials
stringData:
  clientSecret: "<the Value from step 2>"

kubectl apply -f azure-credentials.yml

5. Update your values file

resolve-values.yaml

integrations:
  azure-main:
    type: azure
    create: true
    secretName: azure-credentials
    connection:
      tenantId: "<Directory (tenant) ID>"
      clientId: "<Application (client) ID>"
      subscriptionIds:
        - "<subscription id>"
      # Optional scopes
      # resourceGroups: []
      # logAnalyticsWorkspaceIds: []

6. Apply and verify

helm upgrade --install resolve-satellite \
  oci://registry-1.docker.io/resolveaihq/satellite-chart \
  --values resolve-values.yaml

The connection appears in the ResolveAI Integrations list once the satellite registers it. Verify it with Check Health on the Azure integration page.

​In Azure

​1. Create an app registration

​2. Create a client secret

​3. Grant roles

​In ResolveAI

​4. Add an Azure connection

​5. Add the app registration

​6. Add the optional scopes

​7. Save and verify

​4. Create a Kubernetes secret

​5. Update your values file

​6. Apply and verify

In Azure

1. Create an app registration

2. Create a client secret

3. Grant roles

In ResolveAI

4. Add an Azure connection

5. Add the app registration

6. Add the optional scopes

7. Save and verify

4. Create a Kubernetes secret

5. Update your values file

6. Apply and verify