> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure

Connect from ResolveAI to Microsoft Azure to give the agent access to Azure Monitor logs and metrics, Application Insights telemetry, alerts, and Microsoft Entra sign-in and audit logs to be used in investigations. Access is read-only, and covers Azure Commercial Cloud only.

<Info>
  **Prerequisites**

  * **In Microsoft Entra**: Application Developer, Cloud Application Administrator, or Application Administrator, to create an app registration and add a client secret.
  * **In Azure**: Owner, User Access Administrator, or Role Based Access Control Administrator on each subscription or resource group you grant.
</Info>

***

## In Azure

### 1. Create an app registration

* Open [**Microsoft Entra ID → App registrations → New registration**](https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade).
* Choose **Accounts in this organizational directory only** and leave the redirect URI empty.
* From the app's **Overview** page, copy the **Directory (tenant) ID** and the **Application (client) ID**.

### 2. Create a client secret

* Go to **Certificates & secrets → Client secrets → New client secret**.
* Copy the secret's **Value**, not its **Secret ID**. It is shown only once.

### 3. Grant roles

On each subscription or resource group you want ResolveAI to read, open **Access control (IAM) → Add → Add role assignment** and assign the app the built-in read-only roles for the data you want:

* [**Monitoring Reader**](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#monitoring-reader): Azure Monitor metrics and alerts
* [**Log Analytics Reader**](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#log-analytics-reader): log queries and Application Insights telemetry

<Warning>
  Log Analytics workspaces are often in a different subscription from the resources that log into them. Grant **Log Analytics Reader** on the workspace subscription too, or log queries come back empty.
</Warning>

***

## In ResolveAI

Two ways to connect, both using the app registration from steps 1 to 3.

<Tabs>
  <Tab title="Resolve UI">
    ResolveAI connects directly to your Azure account.

    ### 4. Add an Azure connection

    Open [Integrations](https://app0.resolve.ai/integrations) for your organization, click [**Azure**](https://app0.resolve.ai/integrations/azure/connect), then **Add Connection** at the top right. Give the integration a name (ex. `Azure Prod`) and list its environments (ex. `production` and `staging`).

    ### 5. Add the app registration

    * **Directory (tenant) ID** and **Application (client) ID**: from [step 1](#1-create-an-app-registration)
    * **Client Secret**: the **Value** from [step 2](#2-create-a-client-secret)
    * **Subscription IDs**: the subscriptions you granted in [step 3](#3-grant-roles), from the **Subscriptions** page in the Azure portal

    ### 6. Add the optional scopes

    * **Resource Groups**: narrows reads to named groups in the first subscription. Set it when you granted the roles at resource-group scope.
    * **Log Analytics workspace IDs**: the workspaces to search, from each workspace's **Overview** page, including any holding Microsoft Entra sign-in and audit logs.

    ### 7. Save and verify

    Click **Save**, then verify the connection with **Check Health**.
  </Tab>

  <Tab title="Resolve Satellite">
    The [Resolve Satellite](/resolve-satellite) connects to Azure from inside your cluster, for Azure data behind a private network or when the client secret should not leave your environment. Only the tenant, client and subscription identifiers reach ResolveAI.

    <Info>
      **Prerequisite:** the Resolve Satellite is already installed in your environment. See [Resolve Satellite](/resolve-satellite) for installation instructions.
    </Info>

    ### 4. Create a Kubernetes secret

    ```yaml azure-credentials.yml theme={null}
    apiVersion: v1
    kind: Secret
    type: Opaque
    metadata:
      name: azure-credentials
    stringData:
      clientSecret: "<the Value from step 2>"
    ```

    ```shell theme={null}
    kubectl apply -f azure-credentials.yml
    ```

    ### 5. Update your values file

    ```yaml resolve-values.yaml theme={null}
    integrations:
      azure-main:
        type: azure
        create: true
        secretName: azure-credentials
        connection:
          tenantId: "<Directory (tenant) ID>"
          clientId: "<Application (client) ID>"
          subscriptionIds:
            - "<subscription id>"
          # Optional scopes
          # resourceGroups: []
          # logAnalyticsWorkspaceIds: []
    ```

    ### 6. Apply and verify

    ```shell theme={null}
    helm upgrade --install resolve-satellite \
      oci://registry-1.docker.io/resolveaihq/satellite-chart \
      --values resolve-values.yaml
    ```

    The connection appears in the ResolveAI Integrations list once the satellite registers it. Verify it with **Check Health** on the [Azure integration](https://app0.resolve.ai/integrations/azure) page.
  </Tab>
</Tabs>