Connect Azure
Connect Azure so an agent can use the Azure CLI with credentials from Pulumi ESC.
Choose the service principal
Use a service principal with access to the Azure resources the agent needs. Assign roles at the narrowest scope that covers its work, such as a resource group. See Design access around the job for guidance on credential scope and lifecycle.
Prepare an ESC environment
The Azure CLI integration expects an ESC environment that supplies these environment variables:
| Variable | Value |
|---|---|
AZURE_CLIENT_ID | The service principal’s application ID |
AZURE_CLIENT_SECRET | The service principal’s client secret |
AZURE_TENANT_ID | The Microsoft Entra tenant ID |
AZURE_SUBSCRIPTION_ID | The subscription the agent should use |
Store the client secret as a secret in ESC. The agent also needs permission to open the environment.
Connect the environment
With permission to manage organization integrations (org_integrations:update):
- Open your organization’s Agent settings > Integrations > CLI tools.
- Under Available, choose Azure and select Connect.
- Enter a Name and select the ESC environment that supplies the credentials.
- In Notes (optional), describe when the agent should use this connection.
- Select Connect.
Give the connection a name that identifies its purpose, such as staging-azure. Include the subscription ID and relevant resource groups in its notes.
The Azure CLI requires an explicit service principal sign-in. Setting the environment variables does not sign it in. Add this instruction to the connection notes, replacing <subscription-id> with the subscription ID:
Run Azure sign-in inside a shell launched by
pulumi env runfor this connection. PassAZURE_CLIENT_ID,AZURE_CLIENT_SECRET, andAZURE_TENANT_IDtoaz login --service-principalas the username, password, and tenant. Expand these variables only inside that shell; do not print the environment or credentials. Before querying resources, runaz account show --subscription <subscription-id>and confirm its tenant and subscription match this connection. Use--subscription <subscription-id>for later subscription-scoped commands.
Use the connection
In the task, name the connection and identify the subscription and resources the agent should work with. See Tasks and collaboration to assign work and review the results.