Hygiara
Sign In
Documentation / Connections And Credentials

Connections And Credentials

Azure Permissions

What Azure role Hygiara needs, how to create a service principal, and where to find the credentials.

Hygiara needs an Entra app registration with a client secret and Reader access to the Azure subscriptions you want to review.

What matters

Minimum access:

  • App registration in Microsoft Entra ID
  • Client secret on that app registration
  • Reader role assigned to the service principal on each subscription in scope

For Landing Zone assessment, give the service principal visibility into the management group hierarchy. Assign Reader at the root management group or the highest management group that covers the reviewed subscriptions.

Do this

1. Create an app registration

  1. Open the Azure portal.
  2. Go to Microsoft Entra ID.
  3. Open App registrations.
  4. Click New registration.
  5. Name it, for example hygiara-reviewer.
  6. Leave redirect URI blank.
  7. Click Register.

2. Copy IDs

On the app registration overview page, copy:

  • Application (client) ID - enter this as Client ID
  • Directory (tenant) ID - enter this as Tenant ID

3. Create a client secret

  1. Open Certificates & secrets.
  2. Click New client secret.
  3. Add a description and expiry.
  4. Click Add.
  5. Copy the secret Value immediately.

Azure only shows the secret value once.

4. Assign Reader

For subscription-level access:

  1. Open Subscriptions.
  2. Choose the subscription.
  3. Open Access control (IAM).
  4. Click Add role assignment.
  5. Select Reader.
  6. Select the app registration as the member.
  7. Click Review + assign.

For management-group access, do the same from Management groups. Use this when one connection should cover multiple subscriptions.

Enter it in Hygiara

Add Connection modal - credential fields

Field Value
Name Friendly connection label
Tenant ID Directory tenant ID
Client ID Application client ID
Client Secret Secret value copied from Azure

Check the result

When the connection validates, Hygiara has authenticated and listed subscriptions through the Azure Management API.

If validation fails, check:

  • tenant ID and client ID
  • expired or mistyped secret
  • Reader role assignment
  • RBAC propagation time after a new role assignment

Avoid

  • copying the Object ID instead of the Application client ID
  • assigning Reader to a different app registration
  • expecting new RBAC assignments to appear instantly
  • letting the client secret expire without updating Hygiara