> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enclave.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Enclave in these docs is the code and cloud security platform at enclave.ai. It is not Open Enclave, Intel SGX or other hardware enclaves, or enclave.gg.
> People use Enclave in the web app at https://app.enclave.ai or the desktop app. These docs describe no public Enclave API or CLI, so don't invent endpoints, commands, or config files.
> Connecting an integration needs a person to sign in and approve access in a browser. Tell the user the exact step to take instead of saying you completed it.

# Azure

> Connect your Azure tenant with admin consent and a read-only Reader role, with no secrets to store.

Connect your Azure tenant so Enclave can map the resources and identities in every subscription and link them to your code. Access is read-only, and there are no secrets to store.

## What Enclave needs

Enclave connects through a multi-tenant Microsoft Entra app that Enclave owns. You grant it two things:

* **Admin consent** for the Enclave app. This includes the Microsoft Graph `Directory.Read.All` permission, which Enclave uses to read Entra identities such as service principals, applications, and groups.
* The **Reader** role at your **tenant root management group**. Reader at the root is inherited by every subscription in the tenant, including ones you create later.

### Who can run the setup

* To grant admin consent, you need an Entra role that can consent for the whole organization.
* To run the Cloud Shell command, you need permission to create role assignments at the tenant root management group.
* In Enclave, you need the **Owner** or **Admin** role.

## Connect your tenant

**1. Open the setup page**

Open **Settings → Integrations** and click **Connect** next to **Microsoft Azure**.

**2. Grant admin consent**

Under **Connect Microsoft**, click **Connect Microsoft**. Sign in as an Entra admin and approve the Enclave app for your organization. Enclave waits for the consent, then shows the next step.

**3. Grant tenant-root Reader**

Under **Grant tenant-root Reader**, copy the command. Open [Azure Cloud Shell](https://shell.azure.com) and run it. The command looks like this:

```bash theme={null}
az role assignment create --assignee <enclave-app-id> --role Reader --scope /providers/Microsoft.Management/managementGroups/<tenant-id>
```

**4. Validate**

Back in Enclave, click **Validate**. Enclave checks that it can list your tenant's subscriptions.

After validation, Enclave discovers your subscriptions on its next scan. Each subscription then appears in the connection as its own entry.

## What Enclave discovers

* **Infrastructure**: every resource in each subscription, read through Azure Resource Graph.
* **Network topology**: subnets, routes, and firewall rules.
* **Identities**: role assignments and definitions, managed identities, and Entra service principals, applications, and groups. Enclave links virtual machines and other compute to the managed identities they run as.

## Manage a connection

Open **Settings → Integrations → Microsoft Azure** to see your connected subscriptions.

* **Re-validate** checks that Enclave can still read a subscription.
* **Remove** stops scanning one subscription.
* **Disconnect Azure** removes the whole connection and stops scanning.

To revoke access from Azure, remove the Enclave app's consent in Entra and delete its Reader role assignment at the tenant root.

## What Enclave will and won't do

* **Will**: read resource configuration and identities with the Reader role and `Directory.Read.All`.
* **Won't**: create, change, or delete resources, or read the contents of your files, secrets, messages, or databases. Enclave doesn't store a credential for your tenant. Each scan uses short-lived tokens.

## Troubleshooting

> [accordion] Validation fails
>
> The Reader role assignment is missing or hasn't taken effect yet. Run the Cloud Shell command again, wait a minute, then click **Revalidate**.

> [accordion] The connection shows no subscriptions
>
> If the connection says **Tenant validated. Subscriptions are discovered on the next scan.**, Enclave hasn't scanned yet. To scan now, click **Analyze Environment** in [Coverage](https://docs.enclave.ai/onboarding/coverage.md).

> [accordion] Resources appear, but Entra identities don't
>
> Identity discovery needs the `Directory.Read.All` consent, which is separate from the Reader role. Grant admin consent to the Enclave app again.

> [accordion] The page says admin consent is unavailable
>
> Only owners and admins can start Azure setup. If you have the right role and still see this, contact support.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.