# Connecting Azure

Connect an Azure subscription, or every subscription in a tenant, so Eraser can draw architecture diagrams from the infrastructure you actually have deployed. Eraser reads your environment through an app registration you create yourself, and that app holds nothing but the built-in **Reader** role.

## Quick overview

1. Register the app ([how-to](/connecting-azure#1-register-the-app))
2. Add the federated credential ([how-to](/connecting-azure#2-add-the-federated-credential))
3. Grant the Reader role, on **one subscription** or on **the whole tenant** ([how-to](/connecting-azure#3-grant-the-reader-role))
4. Paste the IDs back into Eraser ([how-to](/connecting-azure#4-paste-the-ids))
5. Pick the subscriptions to import ([how-to](/connecting-azure#5-pick-the-subscriptions-to-import))

Only step 3 changes depending on how much you want Eraser to see. The rest is the same either way.

## What Eraser gets access to

You create an app registration named **Eraser Cloud Connector** and assign it Azure's built-in **Reader** role. Reader grants read access to resource configuration – it does not grant access to the contents of your storage accounts, databases, or key vaults.

No client secret is created – the app uses a **federated credential** instead, and Azure issues a short-lived token at scan time.

Eraser also checks the role assignment before it accepts the connection, and refuses anything broader: an app registration holding more than Reader is rejected.

## Choose a scope

Open **Settings → Cloud connect**, choose **Connect a cloud environment**, and pick **Azure**.

<Figure src="/assets/cloud-azure-connect-pane.png" alt="The Connect Azure form in Eraser, with Single subscription selected" border />

* **Single subscription** grants Reader on one subscription.
* **Multiple subscriptions** grants Reader once on the tenant root management group, which covers every subscription in the tenant – including ones created later.

## 1. Register the app

<Callout kind="warning" title="Required role">
Registering an app requires permission to create app registrations in Microsoft Entra ID.
</Callout>

Choose **Open App registrations in Azure**, then **New registration**. Name it **Eraser Cloud Connector** and choose **Register**.

Keep **Single tenant**, and leave the Redirect URI empty.

<Figure src="/assets/cloud-azure-register-app.png" alt="The Register an application page in Azure, named Eraser Cloud Connector" border />

## 2. Add the federated credential

In the app you just created, open **Manage → Certificates & secrets → Federated credentials → Add credential**, and choose **Other issuer** as the scenario.

Eraser gives you four values to paste:

<Figure src="/assets/cloud-azure-credential-values.png" alt="The four federated credential values in Eraser, each with a Copy button" border />

<Callout kind="warning" title="Replace the pre-filled Audience">
Azure pre-fills **Audience** with its own default. Replace it with the value from Eraser – the connection is refused without it.
</Callout>

Leave **Type** as **Explicit subject identifier**, then choose **Add**.

<Figure src="/assets/cloud-azure-add-credential.png" alt="The Add a credential page in Azure with the four values filled in" border />

## 3. Grant the Reader role

<Callout kind="warning" title="Required role">
Assigning a role needs **Owner** or **User Access Administrator** on the target scope, so this step may be performed by a different person than step 1.
</Callout>

Follow whichever section matches the scope you picked.

### On a single subscription

Choose **Open Subscriptions in Azure** and select the subscription Eraser may read. Open **Access control (IAM) → Add → Add role assignment**.

<Figure src="/assets/cloud-azure-subscription-iam.png" alt="The Access control (IAM) page for a subscription" border />

Pick the **Reader** role and choose **Next**.

<Figure src="/assets/cloud-azure-role-sub.png" alt="The role list with Reader selected" border />

On the **Members** tab, choose **Select members**, search for **Eraser Cloud Connector**, select it, and complete the assignment with **Review + assign**.

<Figure src="/assets/cloud-azure-member-sub.png" alt="The Select members panel with Eraser Cloud Connector selected" border />

Repeat for every subscription Eraser should map. You choose which of them to import in step 5.

### On every subscription in the tenant

One assignment on the tenant root management group covers every subscription beneath it.

Choose **Open Management groups in Azure** and open the **Tenant Root Group**.

<Figure src="/assets/cloud-azure-tenant-root-group.png" alt="The Tenant Root Group overview in Azure" border />

Open **Access control (IAM) → Add → Add role assignment**, pick the **Reader** role, and choose **Next**.

<Figure src="/assets/cloud-azure-role-tenant.png" alt="The role list with Reader selected, scoped to the Tenant Root Group" border />

On the **Members** tab, choose **Select members**, search for **Eraser Cloud Connector**, select it, and complete the assignment with **Review + assign**.

<Figure src="/assets/cloud-azure-member-tenant.png" alt="The Select members panel with Eraser Cloud Connector selected" border />

<Callout kind="note">
Reaching the root management group requires access that a Global Administrator may first need to turn on, using **Elevate access** in Microsoft Entra ID.
</Callout>

## 4. Paste the IDs

Back in **App registrations**, find the app under **All applications** and open it. Its **Overview** page carries both values Eraser needs.

<Figure src="/assets/cloud-azure-app-overview.png" alt="The app registration Overview page showing the Application and Directory IDs" border />

Copy the **Application (client) ID** and the **Directory (tenant) ID** into Eraser, then choose **Continue**.

<Figure src="/assets/cloud-azure-paste-ids.png" alt="The Application ID and Tenant ID fields in Eraser" border />

## 5. Pick the subscriptions to import

Eraser now shows every subscription the app registration can see. Tick the ones it should import.

<Figure src="/assets/cloud-azure-pick-subscriptions.png" alt="The subscription picker in Eraser, with three of five subscriptions selected" border />

Choose **Connect**, and Eraser runs its first scan. Granting Reader on another subscription later, then reconnecting, adds more.

## Prefer the command line?

The connect form can hand you an equivalent `az` CLI script that performs steps 1 to 3 in Cloud Shell. Look for **Copy the equivalent az CLI script** at the bottom of the form.

## After connecting

Each connection appears in **Settings → Cloud connect**, listing the subscriptions it covers and when it last synced.

* **Rescan** reads the tenant again. There is no scheduled background scan – Eraser reads your environment when you ask it to.
* **Active** lets Eraser scan the connection and use it as context in AI chat. **Inactive** stops both, without discarding the connection.
* **Remove from Eraser** disconnects and forgets the connection.

Removing a connection does not delete anything in Azure. To revoke access completely, also delete the app registration and its role assignment.

## Troubleshooting

| What Eraser says | What it means |
|---|---|
| The app registration cannot see any subscription | The Reader assignment from step 3 is missing, or it landed on a different scope. Assign Reader to **Eraser Cloud Connector**, then try again. |
| The app registration holds more than the Reader role | Something assigned an extra role. Eraser refuses write-capable access – remove the extra assignment and keep only Reader. |
| Could not connect that tenant | Usually the federated credential. Check that the **Audience** matches the value Eraser gave you, and that **Type** is **Explicit subject identifier**. |