The agent’s identity
The agent signs in to Azure with its own user-assigned managed identity (id-cloudlens-…), created in the agent’s resource group and deleted with it. There is no app registration, no client secret or certificate, no Microsoft Graph permission and no admin consent. In Microsoft Entra ID it appears under Enterprise applications, filtered to managed identities.
| What you’re doing | Microsoft Entra role you need | Azure role you need |
|---|---|---|
| One or more subscriptions | None | Owner of each subscription |
| The whole tenant or a management group (portal form or scripts) | Global Administrator, only for the optional step below | Owner at the top of the tenant (/) during setup |
| The whole tenant or a management group (Terraform) | None | Owner or User Access Administrator on the management group, and Contributor on the hosting subscription |
Roles the agent gets
| Role | Why |
|---|---|
| Reader | Inventory, Advisor recommendations, resource and service health, policy compliance, backup status, locks |
| Cost Management Reader | Spend, forecast and budgets |
| Monitoring Reader | Fired alerts and diagnostic settings |
| Security Reader | Defender secure score, recommendations, plans and compliance standards |
On its own resources only, the agent can write to its storage account and its key vault, and (with the AI Advisor) use its own model.
Choosing the scope
- A management group (recommended): every subscription below it is covered, including ones created later.
- Specific subscriptions: only those you list.
- This subscription only: the one hosting the agent.
The Cloud Shell script’s default picks the whole tenant when you are allowed to grant access there, and otherwise the current subscription.
Covering the whole tenant (optional)
Only for the whole tenant (the Tenant Root Group) or a management group, with the portal form or the scripts. Do it before you start the setup. A single subscription only needs you to be Owner of it.
The agent’s roles on a management group are granted by a tenant-level deployment, and Azure allows that only for someone who is Owner at the top of the tenant (/). Owner on the Tenant Root Group isn’t enough. A Global Administrator can take it for the setup:
- In the Azure portal: Microsoft Entra ID → Properties → Access management for Azure resources → Yes → Save.
- In Azure Cloud Shell:
az role assignment create --assignee "$(az ad signed-in-user show --query id -o tsv)" --role Owner --scope / - Wait about 10 minutes, then sign out of the Azure portal and back in.
Once CloudLens shows the connection as connected, give it back with az role assignment delete --assignee "$(az ad signed-in-user show --query id -o tsv)" --role Owner --scope / and set the Access management switch back to No. The agent keeps only its read-only roles.
Terraform doesn’t need this: it assigns the roles directly, so Owner or User Access Administrator on the management group is enough.
What the agent cannot do
- Create, change or delete any of your resources.
- Read data inside resources: files, databases, secrets or keys.
- Read your directory: no user lists, names, emails or sign-in logs. MFA checks come from Defender’s own recommendations as pass/fail counts.
Resource names
By default CloudLens never sees resource names or IDs — only counts and anonymous references. You can choose to show names in the setup form if your team prefers.