> For the complete documentation index, see [llms.txt](https://docs.cloud-halo.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloud-halo.io/azure-setup/connect-azure.md).

# Connect Azure

Cloud Halo needs an Azure connection before it can show live cost data, forecasts, recommendations, alerts, allocation results, and reports.

You can connect Azure with either Enterprise Application consent or Service Principal credentials.

## Option 1: Enterprise Application consent

This is the recommended path for most customers.

Use this option when an Azure administrator can approve Cloud Halo for the tenant.

### How it works

1. In Cloud Halo, go to Onboarding or Azure connections.
2. Choose Enterprise Application consent.
3. Enter a connection name, such as Production tenant.
4. Open the Microsoft consent screen.
5. Sign in as an Azure administrator.
6. Approve the requested read-only permissions.
7. Return to Cloud Halo.
8. Assign the required Azure role to the subscription.
9. Paste the subscription ID into Cloud Halo.
10. Verify and finish.

## Option 2: Service Principal

Use this option when your organisation wants to create and manage credentials directly.

You will need:

* Tenant ID
* Client ID
* Client secret
* Subscription ID

### How it works

1. Create or choose a Service Principal in Azure.
2. Assign the required read-only role to the subscription.
3. In Cloud Halo, choose Service Principal.
4. Enter the tenant ID, client ID, client secret, and subscription ID.
5. Cloud Halo validates the connection.
6. Cloud Halo securely stores the secret and starts the first sync.

## What Cloud Halo stores

Cloud Halo stores connection metadata and, for Service Principal connections, the client secret needed to request Azure access tokens.

Secrets are stored server-side and are not shown back to users in the browser.

## Syncing after connection

After the connection is active, Cloud Halo can sync Azure cost data.

You can trigger a manual sync from the Azure connections page. Cloud Halo can also run scheduled syncs when enabled for the workspace.

Each sync can update:

* Cost snapshots
* Historical cost records
* Azure tags used for filtering and allocation
* Azure Advisor recommendations
* Anomaly checks
* Budget and granular cost alerts
* Connection health status

## Connection health

Cloud Halo shows connection health on the overview and Azure connections pages.

Health can be affected by:

* Expired or rotated Service Principal secrets
* Removed Azure role assignments
* Subscription access changes
* Azure API errors
* Billing scope or cost data availability issues

If a connection is degraded, review the latest sync error and validate that the Azure identity still has the required read-only role.

## Service Principal secret expiry

For Service Principal connections, Cloud Halo can record a client secret expiry date when it is available.

If the expiry date is known, Cloud Halo warns when the secret is approaching expiry. If the expiry date is unavailable, sync can still work, but your Azure administrator should track the credential expiry in Azure and rotate it before it expires.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cloud-halo.io/azure-setup/connect-azure.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.