Prepare an Azure service principal
Astrolabe reads the resources and the costs of your Azure subscription with an app registration of Microsoft Entra ID (a service principal). It only reads.
This page was not checked on a live Azure portal: it lists what Astrolabe's form asks for, and where the form says to find it.
What you need
| You need | Where the form says to find it |
|---|---|
| Tenant ID | The Directory (tenant) ID, a GUID shown on the Overview page of the app registration in Microsoft Entra ID |
| Client ID | The Application (client) ID, a GUID shown on the same Overview page |
| Client secret | The Value of a client secret, in the app registration's Certificates & secrets. Azure shows it once: copy the Value, not the Secret ID. |
| Subscription ID | The ID of the subscription to read, a GUID shown in Subscriptions |
🔑 Give it the right roles
The app registration needs two roles on the subscription:
- Reader
- Cost Management Reader
✅ That's it!