Azure

Connecting an Azure subscription to NOFire AI enables automatic discovery of your Azure infrastructure and lets NOFire AI query inventory, cost, and policy-compliance data during investigations. Discovery is subscription-wide: NOFire AI reads every supported resource type across all regions in the subscription, with no per-region configuration. NOFire AI authenticates with an Entra ID service principal and requests read-only Azure RBAC roles. NOFire AI never writes to or modifies Azure resources.

Prerequisites

An Azure subscription, and its subscription ID.
Permission to register an application in your Entra ID tenant (Application Developer or higher).
Permission to assign RBAC roles on the subscription (Owner or User Access Administrator).

Step 1: Register an application in Entra ID

Create the app registration in the Azure portal

Open the Entra ID app registrations blade and click New registration.
Enter a name (for example nofireai-readonly), leave Supported account types on Accounts in this organizational directory only, and leave the redirect URI empty. NOFire AI signs in with client credentials, not a browser redirect.
Click Register.
On the app’s Overview page, copy the Application (client) ID and the Directory (tenant) ID. You need both in Step 3.
Go to Certificates & secrets → Client secrets → New client secret. Add a description, choose an expiry, and click Add.
Copy the secret Value immediately. Azure shows it only once, and this is the client secret you enter in Step 3.

Client secrets expire. Note the expiry date and update the secret on your NOFire AI connection before it lapses, or discovery and Azure queries will start failing with an authentication error.

Alternative: create the service principal with the Azure CLI

This single command registers the application, creates a secret, and assigns the Reader role at subscription scope:

SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"

az ad sp create-for-rbac \
  --name nofireai-readonly \
  --role Reader \
  --scopes "/subscriptions/${SUBSCRIPTION_ID}"

The output carries three of the four values you need in Step 3:

{
  "appId": "<client ID>",
  "password": "<client secret>",
  "tenant": "<tenant ID>"
}

Then add the cost role from Step 2:

az role assignment create \
  --assignee "<appId>" \
  --role "Cost Management Reader" \
  --scope "/subscriptions/${SUBSCRIPTION_ID}"

Alternative: create the service principal with Terraform

If you manage Azure with Terraform, the configuration below creates the application, a client secret, and both role assignments. It requires the azuread and azurerm providers.

data "azurerm_subscription" "current" {}

resource "azuread_application" "nofireai" {
  display_name = "nofireai-readonly"
}

resource "azuread_service_principal" "nofireai" {
  client_id = azuread_application.nofireai.client_id
}

resource "azuread_application_password" "nofireai" {
  application_id = azuread_application.nofireai.id
  display_name   = "nofireai-discovery"
}

resource "azurerm_role_assignment" "reader" {
  scope                = data.azurerm_subscription.current.id
  role_definition_name = "Reader"
  principal_id         = azuread_service_principal.nofireai.object_id
}

resource "azurerm_role_assignment" "cost_management_reader" {
  scope                = data.azurerm_subscription.current.id
  role_definition_name = "Cost Management Reader"
  principal_id         = azuread_service_principal.nofireai.object_id
}

output "azure_subscription_id" {
  value = data.azurerm_subscription.current.subscription_id
}

output "azure_tenant_id" {
  value = data.azurerm_subscription.current.tenant_id
}

output "azure_client_id" {
  value = azuread_application.nofireai.client_id
}

output "azure_client_secret" {
  value     = azuread_application_password.nofireai.value
  sensitive = true
}

Apply, then read the values for Step 3:

terraform apply
terraform output azure_client_id
terraform output -raw azure_client_secret

Step 2: Assign read-only roles

Assign these built-in roles to the service principal at subscription scope. If you used the CLI or Terraform path above, they are already assigned.

Role	Why NOFire AI needs it
Reader	Resource discovery, inventory queries, and policy-compliance state
Cost Management Reader	Cost and forecast queries, which the Reader role alone does not grant

Assign the roles in the Azure portal

Open Subscriptions and select the subscription you are connecting.
Go to Access control (IAM) → Add → Add role assignment.
Select the Reader role, click Next, choose User, group, or service principal, and select your nofireai-readonly application.
Click Review + assign.
Repeat for Cost Management Reader.

Azure RBAC reader roles grant access by scope (subscription, resource group, or resource), not by data category, so a role granted at subscription scope can read every resource beneath it. To narrow what NOFire AI sees, assign the roles at resource-group scope instead and connect one subscription per environment.

Step 3: Add the Azure connection to NOFire AI

Navigate to the Connections tab

In the NOFire AI dashboard, go to Connections.
Click Connect on the Azure card.
Enter your connection details:
- Name: a descriptive label (for example production)
- Subscription ID: the subscription GUID to discover
- Tenant ID: the directory (tenant) GUID, or a verified domain such as contoso.onmicrosoft.com
- Client ID: the application (client) GUID from Step 1
- Client secret: the secret value from Step 1
Click Save.

NOFire AI tests the credentials before saving the connection. The client secret is stored encrypted and is never displayed again.

Once the connection is saved, NOFire AI validates the service principal, discovers the subscription’s supported resources and the relationships between them, and sets the connection status to READY. You can watch the status on the Connections dashboard.

What NOFire AI discovers

Category	Resource types
Organization	Resource Groups
Compute	Virtual Machines, VM Scale Sets, AKS clusters, Azure Functions, App Service and Web Apps, Container Instances
Storage	Storage Accounts, Managed Disks
Databases	Azure SQL Database (including read replicas), Cosmos DB accounts, PostgreSQL Flexible Servers, MySQL Flexible Servers, Azure Cache for Redis
Network	Virtual Networks, Subnets, Network Security Groups, Public IP Addresses, Load Balancers, Application Gateways, NAT Gateways, Route Tables

Discovered resources join the same context graph as your Kubernetes state from NOFire Edge and any other connected cloud or observability source, so an investigation can follow a failing workload through to the Azure resources behind it.

What NOFire AI queries during investigations

Capability	What NOFire AI reads
Resource inventory	Resource attributes, configuration, and tags across the subscription
Cost analysis	Spend queries, forecasts, and cost-anomaly detection
Compliance	Azure Policy compliance state and per-policy evaluation results

Troubleshooting

Connection test fails with an authentication error

Confirm the tenant ID, client ID, and client secret all belong to the same app registration, and that the secret has not expired. Re-copy the secret Value, not the secret ID. The portal displays both, and only the value works.

Connection saves but discovers nothing

The service principal is authenticating but has no Reader assignment on that subscription. Check Access control (IAM) → Role assignments on the subscription and confirm the assignment is at subscription scope, not on a single resource group that holds no supported resources.

Cost queries fail while inventory works

Cost Management Reader is missing. Cost and forecast queries need it in addition to Reader.

Multiple subscriptions

Add one connection per subscription. Subscriptions can share a single Entra ID app registration: assign the same service principal the Reader and Cost Management Reader roles on each subscription, then create a connection per subscription using the same tenant ID, client ID, and client secret with a different subscription ID.

Get Started

Skills

Platform Features

Setup & Integrations

Security

Prerequisites

Step 1: Register an application in Entra ID

Step 2: Assign read-only roles

Step 3: Add the Azure connection to NOFire AI

What NOFire AI discovers

What NOFire AI queries during investigations

Troubleshooting

Multiple subscriptions

​Prerequisites

​Step 1: Register an application in Entra ID

​Step 2: Assign read-only roles

​Step 3: Add the Azure connection to NOFire AI

​What NOFire AI discovers

​What NOFire AI queries during investigations

​Troubleshooting

​Multiple subscriptions

Prerequisites

Step 1: Register an application in Entra ID

Step 2: Assign read-only roles

Step 3: Add the Azure connection to NOFire AI

What NOFire AI discovers

What NOFire AI queries during investigations

Troubleshooting

Multiple subscriptions