Onboarding: Azure¶

An Engineer or Admin can configure the Azure connector from the guided setup without a human handoff. A federated identity credential is the default, so the standing identity has no long-lived secret. See Docs authority & product state.

Access boundary¶

The module creates an Entra application and service principal with these subscription-scoped read roles:

Reader for resource inventory.
Cost Management Reader for billed cost.
Monitoring Reader for Azure Monitor and Log Analytics metadata.

APIM and Event Hubs reads are disabled unless their exact resource IDs are configured. Diagnostic streams can contain content; Venturi retains only allowlisted metadata and never persists prompt or response bodies.

The setup operator needs application-registration permission and Owner or User Access Administrator on the subscription. A CI identity can use Application.ReadWrite.OwnedBy plus role-assignment authority. These setup permissions are separate from the standing read-only identity.

Steps¶

1. Generate configuration¶

Role: Engineer or Admin in Venturi; authorized Entra and Azure RBAC setup principal for the apply.

Select Azure in guided setup. The tenant flow generates the exact issuer, subject, connector ID, and pinned Terraform artifact in-product.

Terraform

subscription_id              = "00000000-0000-0000-0000-000000000000"
use_federated_credential     = true
federated_credential_issuer  = "<generated in guided setup>"
federated_credential_subject = "<generated exact subject>"
enable_apim_access           = false
enable_event_hub_access      = false

2. Deploy and prove the boundary¶

Bash

cd infra/azure/onboarding
az login
az account set --subscription <subscription_id>
terraform init
terraform plan
terraform apply
./scripts/verify.sh

The local script confirms the service principal and role allowlist and proves a write is denied. Connector activation performs positive Cost Management, Resource Graph, Monitor, and enabled scoped telemetry reads through federation.

3. Register outputs and validate¶

Enter the client ID, object ID, tenant ID, subscription ID, and optional scoped resource IDs in the connector step. Automated credential validation checks the issuer and subject match, federation exchange, positive reads, and write denial.

4. Inspect evidence¶

Open the readiness result and the quality feed. Inspect coverage, unknown identity or cost dimensions, and freshness before enabling exports.

Success evidence¶

terraform apply succeeds with a federated identity credential.
verify.sh exits 0 and connector positive reads pass.
Automated credential validation accepts the exact issuer and subject.
The 1st Azure-backed AttributionRecord appears in the quality feed.

Recovery¶

Failure	Action
`AADSTS70021`	Compare the exact generated issuer, subject, and audience with the federated credential, then reapply.
Cost Management returns empty	Confirm the required billing-account, profile, invoice-section, enrollment, or subscription scope.
Azure OpenAI evidence is missing	Identify whether telemetry uses APIM or Event Hubs and add only the exact required resource ID and read scope.
Role assignment fails	Use a setup identity with Owner or User Access Administrator; Global Administrator alone does not grant subscription RBAC.
Freshness becomes stale	Check the readiness probe and latest Monitor or billing timestamp.

Support is an optional escalation path after the failed probe and correlation ID are available.

Rotate or revoke¶

Generate the next exact issuer or subject in connector settings, apply it, and validate federation before removing the previous credential. The default path does not introduce a client secret.

To revoke access, disable the connector in-product, then run: