Microsoft Azure
Antimetal connects to Azure with a read-only Microsoft Entra service principal scoped to the subscriptions you choose. Once connected it can investigate across App Service, Azure SQL, Storage, Service Bus, Function Apps, AKS, Container Apps, Cosmos DB, MySQL, PostgreSQL, Redis, Event Hubs, Data Explorer, and Application Insights.
What Antimetal does with Microsoft Azure
- Query Log Analytics with KQL and read Azure Monitor metrics
- Read Resource Health to see which resources Azure itself considers degraded
- Search the Activity Log to correlate symptoms with configuration changes and deployments
- List resources and read configuration state across monitored subscriptions
Connecting Microsoft Azure
Azure Portal
Prerequisites
- An Azure subscription you want to monitor
- Permission to register applications in Microsoft Entra ID
- Permission to assign roles on the target subscription (Owner or User Access Administrator)
In the Azure Portal, go to Microsoft Entra ID > App registrations > + New registration. Name it
antimetal-monitoring, choose accounts in this organizational directory only, and click Register. Copy the Application (client) ID and Directory (tenant) ID.Go to Certificates & secrets > + New client secret, set a description and expiration, and click Add. Copy the secret Value immediately — it is only shown once.
For each subscription you want monitored, open it and go to Access control (IAM) > + Add > Add role assignment. Select Reader, add
antimetal-monitoringas a member, and confirm. Copy the Subscription ID.Paste the Tenant ID, Client ID, Client Secret, and optionally a default Subscription ID, then click Connect.
Azure CLI
Prerequisites
- Azure CLI authenticated against the target tenant
az ad sp create-for-rbac --name antimetal-monitoring --role Reader --scopes /subscriptions/<SUBSCRIPTION_ID>The output includes
appId(client ID),password(client secret), andtenant. Save these values.az role assignment create --assignee <APP_ID> --role Reader --scope /subscriptions/<SUBSCRIPTION_ID>Paste the Tenant ID, Client ID, Client Secret, and optionally a default Subscription ID, then click Connect.
Follow whichever path matches your deployment — you only need one.
Permissions and access
Antimetal uses a read-only service principal scoped to the subscriptions you select. No write, delete, or configuration changes are performed. Queries against database contents (SQL, Cosmos, MySQL, PostgreSQL, Data Explorer) and Storage blobs require you to separately grant the corresponding data-plane roles — Reader alone does not enable them. If a Log Analytics workspace uses workspace-level access control mode (the default for workspaces created before March 2019), additionally assign Log Analytics Reader at the workspace level. Credentials are stored encrypted and rotate per your Entra app's secret expiration policy; revoke access at any time by deleting the app registration.
| Role | Access |
|---|---|
| Reader (selected subscriptions) | Standard Azure built-in role granting */read across the subscription — view all resources and their configuration, but no data-plane access and no mutations. |
All tenant data is processed in isolated environments. See security and compliance for details.
Related integrations
Need help?
Contact us via Slack or at support@antimetal.com.