Azure connections

Azure connection setup

Create a dedicated identity with read-only access to your Azure subscription, then use it to collect a snapshot in the NetworkLink.EU desktop app. The setup uses the Azure portal; no command line is needed.

Reviewed against Microsoft documentation and the app’s Azure connection flow on 7 October 2026.

Before you begin

• Use an Azure sign-in that can create app registrations in your Microsoft Entra tenant and assign roles on the subscription. If either action is unavailable, ask your Azure administrator to complete that step.
• Use a NetworkLink.EU desktop build with the Azure workspace, and activate your licence on the app’s License page.
• Each Azure subscription uses one slot in your shared AWS/Azure allowance. For example, a 3-account licence can cover two AWS accounts and one Azure subscription.
• This connection supports Azure public cloud with a client secret. Government/China clouds, browser sign-in and certificate authentication are not currently available in the app.

How the connection works

You create an app registration named NetworkLinkEUInventory in your own tenant. Its service principal is the identity to which you grant access. Your desktop app signs in using that registration’s tenant ID, client ID and secret, then reads Azure resource configuration.

The built-in Reader role provides management-plane read access without write permissions or data-plane access. The inventory does not require Microsoft Graph permissions, storage keys or Key Vault secret values. See Microsoft’s Reader role definition.

1. Select your Azure subscription

1. Sign in to the Azure portal. Use the top search bar to open Subscriptions, then select the subscription whose resources you want to collect.
2. Open Overview and copy the Subscription ID. Keep the subscription name with it so you can identify this connection later.
3. Make sure you are working in the Microsoft Entra directory that owns this subscription. If you use several directories, use the portal’s directory switcher to select the correct one before the next step.

2. Create the app registration

1. In the Azure portal, open Microsoft Entra ID → App registrations → New registration.
2. Enter NetworkLinkEUInventory as the name.
3. Under Supported account types, choose the single-tenant option: Accounts in this organizational directory only (also labelled Single tenant only). Leave Redirect URI empty; this app connection does not use a browser redirect.
4. Choose Register, then open NetworkLinkEUInventory → Overview.
5. Copy the Directory (tenant) ID and Application (client) ID. These are different values; do not copy the Object ID in place of the client ID.

See Microsoft’s app registration instructions and service principal overview.

3. Give NetworkLinkEUInventory Reader access

Return to Subscriptions → the subscription selected in step 1 → Access control (IAM) → Add → Add role assignment.

1. On the Role tab, search for and select the built-in Reader role, then choose Next.
2. On Members, set Assign access to to User, group, or service principal.
3. Choose Select members, search for NetworkLinkEUInventory, select the registration you created in step 2, then choose Select. If names are duplicated, use the application/client ID from step 2 to identify yours.
4. Enter a description such as NetworkLink.EU read-only subscription inventory so the assignment is easy to find later.
5. Open Review + assign, check the Reader role, selected identity and subscription scope, then choose Review + assign to confirm.
6. Under Access control (IAM) → Role assignments, confirm that NetworkLinkEUInventory has Reader access to this subscription.

Use the subscription scope so the app can list resources across it. New assignments can take time to become effective. See Microsoft’s role assignment instructions.

4. Create the client secret

Open Microsoft Entra ID → App registrations → NetworkLinkEUInventory → Certificates & secrets → Client secrets → New client secret.

1. Enter a description such as NetworkLink.EU desktop inventory. This helps you identify the secret when replacing it later.
2. Choose an expiry that follows your organisation’s policy and set a reminder to replace the secret before that date.
3. Choose Add, then immediately copy the new secret’s Value. Azure will not display the full value again after you leave this page. Store it securely until you enter it in the app.

Enter these credentials in the desktop app only. Do not paste them into this documentation site, reports or support messages. See Microsoft’s credential management instructions.

5. Add the connection in the NetworkLink.EU desktop app

Continue in the NetworkLink.EU desktop application. Select Azure in the cloud dropdown at the top left, then open Azure connections → Add Azure connection.

Connection name

A name you recognise, such as Production Azure.

Tenant ID

The Directory (tenant) ID copied from NetworkLinkEUInventory in step 2.

Application (client) ID

The Application (client) ID copied in step 2.

Subscription ID

The Subscription ID copied in step 1.

Client secret value

The secret’s Value copied in step 4.

1. Choose whether to enable Remember credentials securely on this computer. When disabled, or when secure OS encryption is unavailable, credentials are kept for the current app session only.
2. Choose Test connection. Read the success or error message directly below the buttons. A successful result identifies the subscription.
3. After a successful test, choose Save connection. Testing alone does not save it. Saving verifies the connection and registers the subscription against your installation’s shared licence allowance.

The saved connection now appears in the Azure connections list. The next action is Collect snapshot.

6. Collect and open a snapshot

1. In the desktop app’s Azure connections page, find the connection you just saved and choose Collect snapshot.
2. The app collects supported resources across the subscription’s regions automatically. There is no Discover regions step for Azure.
3. Wait for collection to finish and review its status. If collection is incomplete, inspect the reported permissions or service errors; missing information does not mean the resources do not exist.
4. Choose Open snapshot to explore the collected resources. The snapshot is also available under History in the Azure workspace.

To collect regularly, open Scheduled snapshots in the Azure workspace and select this connection. The app must remain open and the computer awake. Session-only credentials must be entered again after restarting the app.

Adding another subscription

For another subscription in the same tenant, you can grant the same NetworkLinkEUInventory service principal Reader access there using step 3. Add a separate connection in the desktop app with that subscription’s ID. For a different tenant, repeat the setup in that tenant. Each distinct subscription counts once toward your licence allowance.

Replacing an expiring secret

Open Microsoft Entra ID → App registrations → NetworkLinkEUInventory → Certificates & secrets → Client secrets and create a new, clearly described secret. In the desktop app, open Azure connections → your connection → Replace credentials, enter the new value, then Test connection → Save connection. Update every connection using the old secret before deleting that secret in Azure.

If something does not work

• App registration or role assignment unavailable: ask your administrator to check your setup permissions and selected directory.
• Authentication fails: check the tenant ID, application/client ID and secret value. The secret must belong to NetworkLinkEUInventory and must not have expired.
• Subscription not found or access denied: check the subscription ID, its directory and the Reader assignment for the correct service principal. Allow a new assignment time to take effect, then test again.
• Allowance full: open the app’s License page to review registered AWS accounts and Azure subscriptions. Removing a local connection does not remove its licence registration.
• Connection unavailable after restarting: use Replace credentials to enter session-only credentials again.
• Test succeeds but some resources are missing: the connection test verifies subscription access, not every collector. Check the snapshot’s collection results for incomplete coverage.