azure

Credentials, subscriptions and regions for the Azure collectors.

Keys

Key	Type	Default	Description
subscription_ids	list	[]	List of subscription IDs to scan
tenant_id	null	null	Directory (tenant) ID for service principal, certificate or federated auth.
client_id	null	null	Application (client) ID of the service principal or workload identity.
client_secret	null	null	Client secret for service principal auth.
certificate_path	null	null	Path to a PEM certificate for certificate-based service principal auth.
federated_token_file	null	null	Path to a federated (OIDC) token file for workload identity federation.
use_managed_identity	bool	false	Authenticate with the managed identity of the machine cloudg runs on.
managed_identity_client_id	null	null	Client ID of a user-assigned managed identity
all_subscriptions	bool	true	When subscription_ids is empty, collect every Enabled subscription the credential can see (False: only the first one)
map_management_groups	bool	true	Map the management group / subscription / Azure Policy hierarchy (inventory)
regions	list	[ALL]	Azure locations to scan. Use ['ALL'] for auto-discovery.
map_entra	bool	True	Inventory: map Entra ID (users, groups, apps, service principals, directory roles, PIM) through Microsoft Graph; needs Graph read permissions Not in the example file.
entra_max_objects	int	10000	Inventory: most objects read per Microsoft Graph listing Not in the example file.
entra_max_expansions	int	1000	Inventory: most groups / apps / service principals whose members, owners, federated credentials or app-role assignments are read one by one Not in the example file.
child_resources	bool	True	Inventory: read child resources Resource Graph does not return (APIM APIs, Service Bus queues, DNS records, functions, ...) through ARM REST Not in the example file.
max_child_parents	int	500	Inventory: most parent resources queried per child-resource kind Not in the example file.
diagnostic_settings	bool	True	Inventory: read diagnostic settings of logged resource types Not in the example file.
max_diagnostic_settings	int	1000	Inventory: most resources whose diagnostic settings are read Not in the example file.
data_plane	bool	True	Inventory: read AI Search and Synapse data-plane metadata (data sources, indexers, pipelines, linked services); needs data-plane reader roles Not in the example file.
rest_concurrency	int	8	Inventory: concurrent ARM / Graph REST calls Not in the example file.

In config.yaml

config.yaml (azure)

azure:
  subscription_ids: []     # List of subscription IDs to scan
  tenant_id: null

  # Auth methods, tried in this order:
  # 1. Workload identity federation: tenant_id + client_id + federated_token_file
  # 2. Service principal secret:      tenant_id + client_id + client_secret
  # 3. Service principal certificate: tenant_id + client_id + certificate_path
  # 4. Managed identity:              use_managed_identity: true
  # 5. DefaultAzureCredential chain (env vars, Azure CLI, managed identity)
  client_id: null
  client_secret: null
  certificate_path: null
  federated_token_file: null # nosemgrep: codacy.yaml.security.hard-coded-tokens -- config key for a file path, no token value
  use_managed_identity: false
  managed_identity_client_id: null   # For user-assigned managed identities

  # Inventory mapping (`cloudg map`): Azure Resource Graph is used when
  # azure-mgmt-resourcegraph is installed (pip install cloudg[azure]).
  all_subscriptions: true       # subscription_ids empty -> every Enabled subscription
  map_management_groups: true   # management groups, subscriptions, Azure Policy

  regions:
    - ALL                  # Auto-discover all Azure locations (default)
    # - eastus             # Or specify individual locations
    # - westeurope

Read from the annotated example config.yaml and the CloudGConfig models in cloudg/config.py.