azure-integration

Create an app registration in Azure Active Directory, generate a client secret, and assign Reader and Monitoring Reader roles on the subscription. Then run pup azure accounts create with your tenant ID, client ID, and client secret to register the integration in Datadog.

Update the integration with --cspm-enabled=true and --resource-collection-enabled=true, since CSPM requires resource collection. The app registration also needs the Security Reader role on the subscription for security findings to be collected.

Basic monitoring requires the Reader and Monitoring Reader built-in roles on each subscription. Enabling CSPM additionally requires the Security Reader role. A custom least-privilege role with read actions is also possible.

Set metrics-enabled-default to false and explicitly enable only needed resource providers, disable custom and usage metrics, and apply tag-based host filters to exclude dev and test resources. This can substantially reduce metric volume.

Authentication failures usually mean the client secret is incorrect or expired, the app registration or service principal does not exist, or role assignments are missing. Verify credentials in Azure AD and rotate expired secrets with pup azure accounts update.

Yes, a single app registration can monitor multiple subscriptions if it is granted Reader and Monitoring Reader roles on each one. Alternatively, create separate app registrations per subscription for more granular access control.