Environment Setup
Azure setup guide
Service principal with Reader
Register an Entra ID app and assign the Reader role so IntegraTrace can review your Azure and Entra IAM posture. Your settings are never changed.
Data source
Azure Resource Manager and Azure APIs using an Entra app registration (client credentials flow). IntegraTrace reads configuration; it does not change Azure or Entra settings.
What we read
Subscription resources, RBAC, and configuration with Reader.
Required permissions
An Entra app registration with the Reader role on the subscription.
Identity types
Service principals, managed identities, and user accounts.
Connect your Azure subscription
1
Register an app in Microsoft Entra ID
- ✓Sign in to the Azure Portal at portal.azure.com.
- ✓Open Microsoft Entra ID, then under Manage click App registrations.
- ✓Click New registration and enter a name (e.g. “IntegraTrace Read-Only”).
- ✓Under supported account types, select Accounts in this organizational directory only.
- ✓Leave Redirect URI blank, then click Register.
2
Create a client secret
- ✓On the overview page, note the Application (client) ID and Directory (tenant) ID.
- ✓Open Certificates & secrets and click + New client secret.
- ✓Add a description and choose an expiry period, then click Add.
- ✓Copy the secret Value immediately.
Important
The secret value will not be shown again after you leave this page. You'll need it during IntegraTrace setup.
3
Assign the Reader role on your subscription
- ✓In the portal, search for Subscriptions and select the subscription to connect.
- ✓Note the Subscription ID, then open Access control (IAM).
- ✓Click + Add → Add role assignment and select the Reader role.
- ✓On the Members tab, click + Select members and choose the app you registered.
- ✓Click Review + assign.
4
Enter credentials in IntegraTrace
In IntegraTrace, open the Add Cloud Environment dialog and provide:
- Environment Name: anything you want.
- Cloud Provider: Azure.
- Tenant ID, Client ID, Client Secret, and Subscription ID from the steps above.
- Click Save Environment.
Optional: agent trails (Microsoft Graph)
Only needed if you enable Agent trails for this environment. Use the same app registration and add the optional Directory.Read.All application permission with admin consent.
5
Add Microsoft Graph permissions for agent trails
- ✓Open your app → API permissions → Add a permission → Microsoft Graph → Application permissions.
- ✓Add Directory.Read.All, then click Add permissions.
- ✓Click Grant admin consent for your organization and confirm.
- ✓Confirm Directory.Read.All shows status Granted, type Application.
- ✓Sign-in logs may require Microsoft Entra ID P1 or P2; directory audit events often work without it.
Read-only
Reader and Directory.Read.All are read-only for IntegraTrace's use case. IntegraTrace will not change your Azure or Entra configuration.