> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiomancer.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure

> Connect Azure to Layer to inventory subscriptions, resource groups, RBAC role assignments, and Entra ID identities for unified IAM and compliance reporting.

The Azure integration discovers subscriptions, resource groups, and RBAC role assignments across your Azure environment. Use it to maintain a cloud infrastructure inventory and generate compliance evidence for access-control and asset-management controls in [Axiom Codex](/codex/index).

## What you'll need

* An Azure subscription.
* Permission to create an app registration in Microsoft Entra ID (Azure AD).
* Five minutes.

## Set it up

<Steps>
  <Step title="Register an app in Azure">
    In the Azure portal, go to **Microsoft Entra ID → App registrations → New registration**.

    * Name: `Axiom Layer — Azure`
    * Supported account types: **Single tenant**

    After creation, copy the **Application (client) ID** and **Directory (tenant) ID** from the overview page.
  </Step>

  <Step title="Create a client secret">
    Go to **Certificates & secrets → New client secret**. Copy the secret value — you won't be able to see it again.
  </Step>

  <Step title="Assign the Reader role on your subscription">
    Go to **Subscriptions → (your subscription) → Access control (IAM) → Add role assignment**.

    * Role: **Reader**
    * Assign access to: **Application**
    * Select the `Axiom Layer — Azure` app you just created

    Also copy the **Subscription ID** from the subscription overview page.
  </Step>

  <Step title="Paste credentials into Layer">
    In Layer, go to **Integrations**, find Azure, and click **Connect**. Enter:

    * **Subscription ID**
    * **Client ID** (Application ID)
    * **Client Secret**
  </Step>

  <Step title="Wait for the first sync">
    The initial sync runs immediately and typically finishes in under 10 minutes.
  </Step>
</Steps>

## What gets synced

| Object                | Fields                     | Refresh cadence |
| --------------------- | -------------------------- | --------------- |
| Subscription          | subscription ID, tenant ID | Daily           |
| Resource groups       | name, location, tags       | Daily           |
| RBAC role assignments | principal, role, scope     | Daily           |

Layer also emits a **HostedOn** relationship from every discovered resource group to its parent subscription, with the resource group's `location` stored as relationship metadata. The result is a connected view of how each Azure resource group rolls up to the subscription that owns it — useful when scoping [access reviews](/layer/access-reviews) to a specific subscription, tracing role-assignment blast radius down the hierarchy, and feeding subscription-level evidence in [Axiom Codex](/codex/index).

## Compliance evidence

Azure data generates evidence records for the following SOC 2 controls:

| Evidence                 | Controls            |
| ------------------------ | ------------------- |
| RBAC role assignments    | CC6.1, CC6.2, CC6.3 |
| Resource group inventory | CC6.6, CC6.7        |

See the [SOC 2 evidence catalog](/codex/soc2-evidence-catalog) for full control descriptions.

## Least-privilege permissions

The **Reader** role on the subscription is sufficient for all synced data. If you want to scope access more narrowly, create a custom role with these permissions:

```json theme={null}
{
  "Name": "Axiom Layer Read",
  "Actions": [
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Authorization/roleAssignments/read"
  ],
  "AssignableScopes": [
    "/subscriptions/YOUR_SUBSCRIPTION_ID"
  ]
}
```

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication fails on first sync">
    Verify the Tenant ID, Client ID, and Client Secret are correct. If the client secret expired, generate a new one in **Certificates & secrets** and update it in Layer.
  </Accordion>

  <Accordion title="No resource groups or role assignments appear">
    Confirm the app registration has the **Reader** role (or equivalent) assigned on the target subscription. Role assignments can take a few minutes to propagate after creation.
  </Accordion>

  <Accordion title="I want to monitor multiple subscriptions">
    Create a separate connection for each subscription. Each connection requires its own Subscription ID but can share the same app registration if you assign the Reader role on each subscription.
  </Accordion>
</AccordionGroup>