# Microsoft Azure

> Azure subscription posture and policy state. Prerequisites, setup steps and troubleshooting.

Source: https://docs.csquaregrc.com/connectors/azure

## What it does

The Azure connector reads subscription posture through Azure Resource Manager: role assignments, network security groups, key vaults and the activity log. It is read-only and never changes a resource.

## Prerequisites

- A cSquare GRC workspace where you are an **owner** or **admin**.
- Connection method: **API key or token**.
- Access needed at Microsoft Azure: Read-only. The built-in Reader role on the subscription is enough.

## Set up

Open **Settings > Integrations** in [the app](https://app.csquaregrc.com), find Microsoft Azure, then:

1. Register an application in Entra ID (or reuse the one behind your Entra ID connector) and note the tenant ID and client ID.
2. Create a client secret for that application and copy it immediately.
3. In the subscription you want monitored open Access control (IAM) and assign the built-in Reader role to that application.
4. Copy the subscription ID from Subscriptions in the Azure portal and paste all four values here.

## Verify the connection

1. Back in **Settings > Integrations**, Microsoft Azure should show **Connected** with a recent sync time.
2. Open **Evidence** and filter by source **Microsoft Azure**. The first sync can take a few minutes.
3. Open a control that depends on Microsoft Azure and confirm the new evidence is linked.

## AI prompts

Paste these into Fibo in the app, or into any assistant connected through [MCP](/mcp/connect).

```text
I just connected Microsoft Azure to cSquare GRC. Check that it is syncing, list the evidence it has collected so far, and tell me which controls in my active programs now have evidence from Microsoft Azure.
```

```text
Which controls in my programs could be covered by Microsoft Azure evidence but still have no current evidence? Group them by framework and suggest what to collect.
```

## Troubleshooting

### AuthorizationFailed on every data type

The app registration has no role on the subscription. Assign Reader at subscription scope, not just at a resource group.

### Activity log returns nothing

The collector bounds the query to the last seven days. A quiet subscription legitimately returns zero events.

### Subscription ID is required

Identity-only credentials were saved. Add the subscription ID to the connector, or use the Entra ID card if you only want identity evidence.

### Test connection fails immediately

Nine times out of ten the credential was pasted with a trailing space, or it was issued in a different tenant or region. Re-copy it and try again.

### The connector is quarantined

Collection paused after three consecutive failures. Fix the credential, then use Re-test and re-enable on the Active connections tab; it only resumes when the test passes.

### Connected, but no evidence appears

Check that at least one collection type is selected and that the account can see the resources. Read-only accounts scoped to a single project will only return that project.

### Still stuck?

```text
My Microsoft Azure connector in cSquare GRC is failing. Here is the error I see: <paste error>. Walk me through the likely causes and the exact fix, step by step.
```