Connect Microsoft Azure

1. What it collects

Once a day, and when a workspace owner or admin presses Run now, StackWeaver reads one subscription through the Azure management API (how it works). Each result is kept as an Evidence Object with a SHA-256 fingerprint (platform), including results that fail. StackWeaver keeps only the tenant id and the subscription id, and no secret of yours (what is stored).

2. What it does not do

• It cannot change anything: the Reader role views resources and allows no changes (Microsoft). It reads the control plane only, never keys, secrets or data (how it works).
• It does not store a password, key or client secret of yours. The only credential is StackWeaver's own Microsoft app (what is stored).
• It reads one subscription per connection: the one you give the Reader role on.
• It does not issue certifications. A named reviewer decides whether evidence is accepted (editorial policy).

3. The access it needs

There are two separate approvals, and you control both.

• Approve the app. An administrator of your tenant approves StackWeaver's app; Microsoft requires a tenant administrator to sign in to complete the request (Microsoft). Microsoft's page lists the same four read-only Microsoft Graph permissions the Microsoft Entra ID connector uses, even if you only connect Azure (how it works). The Azure checks do not use them. They are read-only, and deleting the StackWeaver enterprise application in your tenant removes them together with the approval (Microsoft).
• Give the app the Reader role on one subscription. Reader is a built-in Azure role that views all resources and allows no changes (Microsoft).

To assign a role you need permission to write role assignments, for example Role Based Access Control Administrator or User Access Administrator (Microsoft).

Who can connect. Two things must both be true. First, in StackWeaver you must be a workspace owner or admin. Second, in Microsoft the account you sign in with must be a Global Administrator or a Privileged Role Administrator of the tenant, and hold that role right now: after you sign in, StackWeaver asks Microsoft which administrator roles that account holds, and connects only if one of the two is found (how it works). This is checked because approving the app gives StackWeaver read access to the whole tenant, so only someone who can decide that for the tenant should be able to connect it. If Microsoft cannot be asked, or does not answer clearly, StackWeaver does not connect.

If you use Privileged Identity Management. A role you are only eligible for is not active, so it does not count: an eligible assignment needs you to perform one or more actions before the role can be used (Microsoft). Activate the role in Microsoft first, wait for it to show as active, then press Connect again.

4. Connect steps

1. In StackWeaver, open Evidence, then the Microsoft Azure evidence section, and press Connect Microsoft Azure. Only a workspace owner or admin sees the button.
2. Sign in to Microsoft as a Global Administrator or Privileged Role Administrator of your tenant (active, not only eligible) and approve. Microsoft then asks you to choose the account you are signing in with. StackWeaver learns which tenant you belong to from the signed reply Microsoft sends, not from the address it was sent back to (Microsoft, how it works), and asks Microsoft to confirm that your tenant approved the app before it saves anything.
3. If StackWeaver can see no subscription yet, the card says Reader role not assigned yet and shows a command. In Azure Cloud Shell or the Azure CLI, replace the subscription id and run it: az role assignment create --assignee (StackWeaver's app id, shown on the card) --role Reader --scope /subscriptions/(your subscription id). The assignee can be a service principal name, which is the app's client id (Microsoft). Or in the Azure portal: open the subscription, then Access control (IAM), Add, Add role assignment, choose the Reader role, then Members, Select members, and pick the StackWeaver app (Microsoft).
4. Press Check again. If the app can read several subscriptions, choose the one StackWeaver should read. StackWeaver tests the connection, and when the card says Connected you can press Run now.

5. Reading the results

6. Disconnect and revoke

1. In the StackWeaver portal, open Evidence, Microsoft Azure evidence, and press Disconnect. StackWeaver deletes the tenant id and subscription id it stored, and collection stops. Evidence already collected stays (how it works).
2. To remove the Reader role, open the subscription's Access control (IAM), the Role assignments tab, and remove the StackWeaver app's assignment (Microsoft).
3. To remove StackWeaver's approval, an administrator of your tenant deletes the StackWeaver enterprise application: in the Microsoft Entra admin center, browse to Entra ID, then Enterprise apps, select the application, open Properties, select Delete and confirm (Microsoft).

What remains. Past evidence stays in your workspace as the audit trail unless you ask for deletion. How StackWeaver keeps and deletes data is in the privacy policy. To ask for deletion, write to [email protected].

7. Troubleshooting

Still stuck? Use the contact page.