Connect Azure

Before you start

• An account that is Owner of the Azure subscription that will host the agent. The setup gives the agent read-only roles, which needs Owner (or User Access Administrator).
• No Microsoft Entra role for a subscription. The agent uses its own managed identity: no app registration, secret or admin consent. See The agent’s identity.
• Optional, only to cover the whole tenant or a management group: be Owner at the top of the tenant (/) while you set up. Only a Global Administrator can do this, in a few minutes; see Covering the whole tenant. Not needed with Terraform.
• Microsoft Defender for Cloud on your subscriptions. The free tier is enough for the secure score, security recommendations, MFA checks and compliance standards.

Get your setup code

In CloudLens open Connections → Add a cloud connection → Microsoft Azure, name the connection (for example “Azure – Production”) and continue. You’ll see a setup code. It works once and expires after 24 hours; if it expires, choose New token. Keep the page open: it turns green on its own when the agent connects.

Option 1: Azure portal (recommended)

1. Copy the setup code and choose Open the Azure portal.
2. On Basics, choose the subscription, create a resource group (for example rg-cloudlens-agent), pick a region and paste the setup code.
3. On Monitored scope, choose a management group — the Tenant Root Group covers everything — or This subscription only.
4. Optionally, on AI Advisor, tick Add CloudLens Advisor and choose where it may process data. See AI Advisor.
5. Choose Review + create, then Create. It takes three to five minutes.

Option 2: Cloud Shell script (Bash or PowerShell)

1. Open Azure Cloud Shell, signed in as a subscription Owner.
2. In CloudLens choose the Bash script or PowerShell script tab, pick what CloudLens should see, the region and the AI option, and copy the command.
3. Paste it and press Enter. The script shows the subscription, scope, region and AI choice, and asks Continue? before it changes anything.

The script is safe to run again if something fails halfway. You can read it first by opening the link shown under the command. Useful options: --tenant, --management-group <id>, --subscriptions <id,id>, --location <region>, --ai (PowerShell: -Tenant, -ManagementGroup, -Subscriptions, -Location, -Ai).

Option 3: Terraform

Choose the Terraform tab and copy the module block into your configuration. It already contains your setup code and settings. Sign in with az login, then run terraform init and terraform apply. Use Terraform 1.6 or later.

After it connects

• CloudLens shows each data source as Working, Partly working, Needs attention or Not set up, with the reason. Role assignments can take up to ten minutes to apply, so if something says “not authorized”, wait and choose Collect again now.
• The first collection starts immediately, then runs every six hours.
• Cost data can take up to a day to appear on a new subscription. Free-trial and sponsorship subscriptions may not provide cost data at all.

What gets created

One resource group holds everything. Outside it, only the read-only role assignments on the scope you chose.

Agent size and cost

You choose the size in the portal form (Agent size), the scripts (--size) or Terraform (agent_size). Everything runs and is billed in your Azure.

These are list-price estimates; check the Azure pricing calculator for your region. Storage, logs and the key vault add a little. The AI Advisor’s model usage is billed by Azure in your subscription, usually around a dollar a month. Flex Consumption isn’t offered in every region; if the region you pick doesn’t have it, choose another region or the Premium size.

Names and tags

Names follow type-cloudlens-environment-region, with a short suffix only on names that must be unique across all of Azure. The suffix comes from the resource group, never at random, so running the setup again updates the same resources instead of creating new ones.

• Environment (default prod) and the region code (from the region) appear in every name.
• Suffix: automatic, your own (for example 001), or none. With none, the names must be free across Azure, including key vaults deleted in the last 7 days.
• Exact names: Terraform (resource_names) and the template (resourceNames) accept your own name for any resource.
• Tags: add your own (for example Owner or Cost Center) in the portal form, with --tag key=value in the scripts, or tags in Terraform. Application=CloudLens is always added.
• Zone redundancy is optional: it spreads the agent and its storage across availability zones, costs more, and needs a region with zones.

Azure resources can’t be renamed: changing a name later creates a new resource.

If the deployment fails

Fix the cause, then deploy again into the same resource group with the same settings; there’s no need to delete anything first. Azure keeps what was already created and adds what’s missing. Your setup code still works if the agent never connected and it’s less than 24 hours old; otherwise choose New token in CloudLens.

• “Operation cannot be completed without additional quota”: your subscription has no quota for that hosting plan in that region. Request more under Quotas in the Azure portal, or pick another region or size.
• Starting over after deleting the resource group: Azure keeps a deleted key vault for 7 days, and it still holds its name. The Cloud Shell scripts clean it up for you. With the portal form or Terraform, first run az keyvault purge --name <vault name> (find it with az keyvault list-deleted), or use a new resource group name.
• Purge protection is off by default, so this cleanup is always possible. If your Azure Policy requires it, turn it on in the form (Naming and tags), with --kv-purge-protection, or key_vault_purge_protection in Terraform. A purge-protected vault can’t be removed early, so reinstalling into the same resource group then has to wait 7 days.