Connect Azure

This guide shows you how to create an Azure service principal with the roles VikingCloud needs to scan your subscription. Choose either the Portal (GUI) method or the CLI method below.

Required Roles

Method 1: Azure Portal (GUI)

Step 1: Register an Application

1. Sign in to the Azure Portal
2. Navigate to Microsoft Entra ID > App registrations > New registration
3. Enter:
   • Name: vikingcloud-platform-sp
   • Supported account types: Accounts in this organizational directory only
4. Click Register
5. Note the Application (client) ID and Directory (tenant) ID from the overview page

Step 2: Create a Client Secret

1. In the app registration, go to Certificates & secrets > Client secrets > New client secret
2. Enter a description (e.g., VikingCloud Scanner)
3. Select an expiration (recommended: 12 months)
4. Click Add
5. Copy the Value immediately — it will not be shown again

Step 3: Assign Roles

1. Navigate to Subscriptions and select your subscription
2. Go to Access control (IAM) > Add role assignment
3. Add each of the following roles, assigning them to the vikingcloud-platform-sp application:
   • Reader
   • AcrPull
   • Disk Snapshot Contributor
   • Virtual Machine Contributor
4. For each role: search for the role name, click Next, select User, group, or service principal, click Select members, search for vikingcloud-platform-sp, select it, and click Review + assign

Step 4: Enter Credentials in VikingCloud

1. In VikingCloud, go to Settings > Connections
2. Click Add Connection and select Azure
3. Enter the following:

4. Click Save

Method 2: Azure CLI

Prerequisites

• Azure CLI installed and signed in (az login)

Step 1: Create the Service Principal and Assign Roles

# Get your subscription ID
SUBSCRIPTION_ID=$(az account show --query id -o tsv)

# Create service principal with Reader role
az ad sp create-for-rbac \
  --name vikingcloud-platform-sp \
  --role Reader \
  --scopes /subscriptions/${SUBSCRIPTION_ID}

# Output will include:
# {
#   "appId": "...",       ← Client ID
#   "password": "...",    ← Client Secret
#   "tenant": "..."       ← Tenant ID
# }
# Save these values — you will need them for VikingCloud.

# Get the service principal's App ID
SP_APP_ID=$(az ad sp list --display-name vikingcloud-platform-sp --query [0].appId -o tsv)

# Add AcrPull role (container scanning)
az role assignment create \
  --assignee ${SP_APP_ID} \
  --role AcrPull \
  --scope /subscriptions/${SUBSCRIPTION_ID}

# Add Disk Snapshot Contributor (VM scanning — snapshots)
az role assignment create \
  --assignee ${SP_APP_ID} \
  --role "Disk Snapshot Contributor" \
  --scope /subscriptions/${SUBSCRIPTION_ID}

# Add Virtual Machine Contributor (VM scanning — scanner VMs)
az role assignment create \
  --assignee ${SP_APP_ID} \
  --role "Virtual Machine Contributor" \
  --scope /subscriptions/${SUBSCRIPTION_ID}

Step 2: Enter Credentials in VikingCloud

Use the appId, password, and tenant from the service principal creation output. Enter them in VikingCloud under Settings > Connections > Add Connection > Azure.

Verification

Verify all roles are assigned:

az role assignment list \
  --assignee $(az ad sp list --display-name vikingcloud-platform-sp --query [0].appId -o tsv) \
  --output table

Expected roles: Reader, AcrPull, Disk Snapshot Contributor, Virtual Machine Contributor.

Troubleshooting

Permission Denied Errors

List all role assignments for the service principal:

az role assignment list --all --output table

Client Secret Expired

Create a new client secret in Microsoft Entra ID > App registrations > vikingcloud-platform-sp > Certificates & secrets, then update the credential in VikingCloud.

Security Notes

• Scoped by tags: All VikingCloud-created resources are tagged with owner=vikingcloud
• Ephemeral resources: Scanner VMs and snapshots exist only during scans, typically under 10 minutes
• Read-only data access: VikingCloud reads disk data via snapshots but never modifies your VMs
• Resource group isolation: Scanner VMs are created in a dedicated resource group
• Rotate secrets every 12 months as recommended by Microsoft