connect-azure

Name: connect-azure
Availability: InStock
Author: SubImage

Create an Azure service principal with Reader role for SubImage inventory access.

Updated Apr 30, 2026

Search Tags:#onboarding #azure #terraform #az-cli #service-principal #subimage

Ready to run

npx skills add https://github.com/subimagesec/skills --skill connect-azure-subimagesec

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: connect-azure
Source: https://github.com/subimagesec/skills/tree/main/plugins/subimage-setup/skills/connect-azure
Command: npx skills add https://github.com/subimagesec/skills --skill connect-azure-subimagesec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Connects an Azure tenant to SubImage by creating a service principal, assigning Reader access, and preparing the account for resource-plane inventory.

Core Features & Use Cases

Onboards one or more Azure subscriptions or a Management Group root into SubImage.
Supports both Terraform and az CLI workflows, making it useful for infrastructure-as-code repositories and one-off setup tasks.
Helps teams automate subscription inventory for resources and resource groups while keeping Entra and Intune expectations clearly separated.

Quick Start

Ask me to connect Azure to SubImage using your tenant ID, the subscription or Management Group scope, and either Terraform or az CLI.

Frequently Asked Questions about connect-azure

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I onboard an Azure subscription to SubImage using a service principal?▼

To onboard an Azure subscription to SubImage, you create a service principal, generate a client secret, assign Reader role access for inventory, and configure the tenant ID and subscription scope using either Terraform or az CLI.

Can I connect a Management Group root to SubImage instead of individual subscriptions?▼

Yes, you can connect a Management Group scope to SubImage. Onboarding a Management Group root rolls out access across grouped subscriptions, and you can enable sync-all-subscriptions configuration to verify complete inventory coverage.

What permissions does the service principal need for Azure subscription inventory access?▼

The service principal requires Reader role assignments scoped to your Azure subscription or Management Group. Reader access is sufficient to perform resource-plane inventory by scanning resources and resource groups without enabling administrative changes.

Does the Azure onboarding process support Terraform for infrastructure-as-code repositories?▼

Yes, the Azure onboarding process fully supports Terraform alongside az CLI workflows. This allows teams to automate service principal creation and Reader role assignments within their infrastructure-as-code repositories for consistent subscription scans.

Do I need to configure Entra ID or Intune separately to connect Azure to SubImage?▼

No, connecting Azure to SubImage only requires tenant ID, subscription scope, and Reader permissions for resource-plane inventory. The setup explicitly separates Entra and Intune expectations, keeping onboarding focused on subscription resource access.