Connect Azure

Connect an Azure subscription to an environment by granting Proofline read access through a managed identity in that subscription. Proofline checks the access and shows whether the connection is verified. A verified connection proves only that Proofline can sign in with Reader access. Proofline does not collect Azure resources through it, so it adds no evidence to reviews.

An organization administrator adds and verifies the connection. You also need permission in the subscription to create a managed identity and assign the Reader role.

Add the subscription#

1. Open the environment, then select Setup → Azure.
2. Select Add subscription.
3. Copy the Identity command and run it with the Azure CLI. Replace SUBSCRIPTION_ID, RESOURCE_GROUP and REGION first. The command creates a managed identity and prints its resource ID, client ID and tenant ID.
4. Enter the Managed identity resource ID, Client ID and Entra tenant ID it printed. A Subscription name is optional and only labels the connection.
5. Select Add subscription.

Create a new identity for each connection. The next step replaces the identity's tags, and the identity must not be shared with anything else.

Grant access#

The new subscription appears with the state Unverified.

1. Select Download template.
2. Copy the Deployment command, replace REGION with the identity's region, and run it in the folder where you saved the template.
3. Select Verify.

The deployment updates the identity you created. It tags the identity with the connection, adds a federated credential that trusts Proofline for this connection only, and assigns Reader on the subscription. Running it again with the same command changes nothing.

Read the result#

• Verified: the identity, its tag and the Reader assignment match the connection.
• Unverified: no check has passed yet. If Azure could not be reached, the reason appears under the subscription. Select Verify again later.
• Refused: Azure or the subscription refused access. The reason names what to fix, such as the federated credential's audience, the identity's tag or the Reader assignment. Run the deployment command again, then select Verify.

Select Verify again after you change the identity or its role assignments. Proofline checks with a new token each time.

Permission manifest#

The connection asks for one permission: the built-in Reader role, assigned directly on the subscription to the connection's managed identity, with no condition. An assignment inherited from a management group, or one with a condition, does not count.

• Reader allows control-plane reads of resources in the subscription. It grants no write access and no access to secret values.
• Proofline does not read Key Vault contents, Log Analytics data or directory information, such as the names of users and service principals.
• The connection covers only its own subscription.

A new permission would need a new manifest that an administrator installs and verifies. An existing connection's permissions do not grow.

Remove access#

Select Revoke and confirm. Proofline stops issuing Azure tokens for the subscription at once. Tokens issued earlier stay valid until they expire. To withdraw access in Azure, remove the identity's Reader assignment, then delete the identity.