What you need

Kumo.io signs in to Azure as a service principal (an app registration) that has a client secret. You need:

• the Subscription ID of the subscription to read,
• the Tenant ID of the Microsoft Entra tenant the service principal belongs to,
• the service principal's Client ID (its application ID),
• a Client secret for it.

Give the service principal the Reader role on the subscription. Reader lets Kumo.io list and read resources but not change them.

A service principal with a client secret is the only way to connect Azure today. Managed identities, workload identity and certificate credentials aren't supported yet, on kumo.io or on self-hosted Kumo.io.

Create the service principal

In the Azure portal or with the Azure CLI:

1. Register an application in Microsoft Entra ID, and note its Application (client) ID and Directory (tenant) ID.
2. Create a client secret for the application, and copy its value.
3. On the subscription, under Access control (IAM), assign the Reader role to the application.

With the Azure CLI, the following does all three in one step and prints the values Kumo.io needs (appId is the client ID, password is the client secret, tenant is the tenant ID):

az ad sp create-for-rbac --name kumo-reader --role Reader \
  --scopes /subscriptions/<subscription-id>

Client secrets expire. Note the expiry date, and replace the credential in Kumo.io before it passes (see Credentials).

Connect it to Kumo.io

1. Open Cloud Connections and select Add a Source, or select Add Source on a workspace's Connections tab.
2. Under 1 · Choose a Provider, pick Microsoft Azure.
3. Under 2 · Enter the Credential, fill in Subscription ID, Tenant ID, Client ID and Client secret. The subscription and client IDs are GUIDs; the tenant is its GUID or its domain (contoso.onmicrosoft.com). Kumo.io flags a value of the wrong shape on its field before sending anything.
4. Pick the Workspace it syncs into. To give the source a Name, open Advanced Options.
5. Select Test Connection to check the credential, then Connect Source.

Kumo.io stores the credential, finds the subscription, creates the source and starts the first sync.

To connect more subscriptions, add a source for each one. They can share a service principal: give it Reader on each subscription, then either enter the same values with a different Subscription ID, or pick Use an Existing Credential and enter the subscription (see Reuse a credential).

What Kumo.io reads

Kumo.io reads the subscription through Azure Resource Graph and the Azure Resource Manager API, using read calls only. It currently recognises 113 Azure resource types across 46 services. See Azure coverage for the full list.

Kumo.io reads one subscription per source. It does not yet read management groups, so connect each subscription separately.

Connect from the CLI

kumo source connect runs the same flow as Add a Source. Pass the credential as one line of JSON on standard input so it never lands in your shell history:

echo '{"tenantId":"<tenant-id>","clientId":"<client-id>","clientSecret":"<client-secret>"}' | \
  kumo source connect --provider azure --credential-kind azure.service_principal \
    --display-name "prod subscription" --secret-material-stdin --scope <subscription-id>

Add --no-sync to skip the first sync. See the CLI reference.

If the connection fails

Test Connection, the source's credential health panel and the sync's diagnostics report what went wrong. Common Azure problems and their fixes: