Azure connection instruction
What you'll need: access to Azure Portal with Global Administrator role in the directory containing the subscription you want to connect.
Step 1. Switch to the correct directory In the Azure Portal, click your account name in the top-right corner → Switch directory and select the directory that contains the subscription you want to connect to emma. If you only have one directory, you can skip this step.
Step 2. Enable access management for Azure resources Go to Microsoft Entra ID → Properties and enable Access management for Azure resources. Save the setting. This grants the script permission to assign roles within your subscription. Without it, the script will fail at the permissions step.
Step 3. Grant Admin Consent Go to App registrations → All applications, find your enterprise application, open API Permissions and click Grant admin consent for [your tenant name]. Without this step the connection validation will fail.
Step 4. Download the script archive Download the Azure archive from the public repository — the link is here. Unzip the archive. Keep all files in the same folder — the script references them by relative path.
Step 5. Fill in the configuration file
Open azure-config.json from the archive and fill in the following fields:
| Field | Where to find it |
|---|---|
| subscriptionId | Azure Portal → search Subscriptions → copy the ID of your target subscription |
| domain | Your organisation's domain, e.g. yourdomain.onmicrosoft.com |
Leave all other fields as-is — they will be populated automatically by the script.
Step 6. Run the script
Open Azure Cloud Shell (Bash mode) inside your Azure Portal. Copy the full contents of configure.sh and paste into the shell. Press Enter.
The script will:
- Create an Enterprise Application and a dedicated service user
- Assign the required permissions (without touching your existing roles)
- Output all credentials needed for the emma connection
When complete, the terminal will display:
Script execution completed successfully.
client_id: <value>
client_secret: <value>
tenant_id: <value>
subscription_id: <value>
service_email: <value>
service_password: <value>Keep this file safe. It contains credentials that grant access to your project. Do not share it or commit it to version control.
Step 7. Enter credentials in emma In the selected provider's input table, fill in the following fields:
| emma field | Value | Source |
|---|---|---|
| Client ID | client_id | script output |
| Client Secret | client_secret | script output |
| Subscription ID | subscription_id | script output |
| Tenant ID | tenant_id | script output |
| Service email | service_email | script output |
| Service password | service_password | script output |
Click Connect account. emma will validate the connection using the Azure SDK. On success, the provider status will change to CONNECTED and the discovery button will become available.
Troubleshooting If the connection fails, the status will remain NOT CONNECTED and an error message will appear. Check the most common causes below:
| Symptom | Likely cause | Fix |
|---|---|---|
| Permission error during script | "Access management for Azure resources" not enabled | Repeat Step 2 |
| Connection validation fails | Admin Consent not granted | Repeat Step 3 |
| Script finds wrong subscription | Wrong directory selected | Repeat Step 1 |
| invalid_client error | client_secret copied incorrectly or expired | Re-run the script, copy credentials again |
| Config-related script error | subscriptionId or domain missing in azure-config.json | Check Step 5 |
Previous entries are not saved — you can re-enter new credentials at any time without restrictions.
Last updated on 14 Jul 2026