Connector · Azure
Connect Azure
Service principal + Microsoft Graph org lookup. Tenant-scoped, no Directory.ReadWrite.All.
Permission scope
- Microsoft Graph: User.Read.All (org lookup) — confirms the tenant the probe runs against.
- ARM (Azure Resource Manager): Reader role at the subscription (or per-RG if narrower).
- Optional: Key Vault Secrets User on the vaults you want Yarrow to govern.
- Yarrow never requests Directory.*.Write, no Application.ReadWrite.All, no Global Admin.
- Multi-tenant: one app per tenant, one connector per app, in the workspace connectors list.
What Yarrow asks for
These are the exact fields the live connector setup flow accepts for Azure. Anything you prepare here matches what you provide there.
| Field | Required | Note |
|---|---|---|
| label | required | Short workspace identifier. e.g. prod-azure-tenant. |
| tenantId | required | UUID. The Azure AD tenant the app registration lives in. |
| clientId | required | UUID. The application (client) ID of the registered app. |
| clientSecret | required | A client secret value (not the secret ID). Stored encrypted, never echoed back. |
| subscriptionId | optional | UUID. Scope the ARM Reader role if you do not want Yarrow to enumerate all subscriptions in the tenant. |
Steps
- 1
Register an app in Entra ID
Azure Portal → Microsoft Entra ID → App registrations → New registration. Set the redirect URI to "Web" and use any placeholder — Yarrow does not redirect.
- 2
Add a client secret
Certificates & secrets → New client secret. Copy the VALUE (not the Secret ID) — Azure only shows it once. Place it somewhere safe for the connector setup flow.
- 3
Grant API permissions + role
API permissions → Microsoft Graph → Application permission → User.Read.All (admin consent required). Subscriptions → Access control (IAM) → Reader on the subscription Yarrow will govern.
- 4
Open the workspace connector roster
/workspaces/<slug>/connectors → choose the Azure setup guide.
- 5
Prepare label, tenant, client, secret; subscription optionally
Tenant and client IDs are UUIDs. The probe runs a User.Read.All call against Microsoft Graph.
- 6
Return to the roster to review status
Once the connection is configured, a green card confirms Graph returned the org the tenant belongs to. A red card shows the Graph error verbatim — typically missing admin consent or a copied Secret ID instead of the secret value.
Verify
After the Azure connection is configured, Yarrow runs a reachability probe: one minimal permissions call against the cloud, then stores the encrypted bundle under the chosen label. A green card confirms the probe passed. A red card shows the cloud's error verbatim — rotate keys, fix the IAM policy, and try again.
Failed probes still save the bundle so you can inspect and rotate without re-pasting.