Azure Resources
Published on May 25th, 2026Introduction
The Context Store has several Azure Resources templated Data Sources to allow users to quickly pull relevant data into their Data Store.
These templates are a starting point and often you'll want to apply filters or chained Data Sources to modify these templates to suit your needs.
Authentication
The Azure Resource Integration shares configuration with Microsoft Graph.
It requires an application to be setup within your Microsoft instance.
Tenant ID, Client ID and Client secret are required to authenticate calls to retrieve resources.
Pre-built Data Sources
This table lists the Azure Resource Manager (ARM) read permissions needed for the Azure data source seeds currently defined in this repo.
| Data source seed | ARM endpoint(s) used | Required permission / role |
|---|---|---|
Azure subscriptions | GET /subscriptions?api-version=2022-12-01 | Tenant-level ability to enumerate subscriptions (commonly covered by Reader on each target subscription) |
Azure resource groups | GET /subscriptions then GET /subscriptions/{subscriptionId}/resourcegroups?api-version=2022-09-01 | Microsoft.Resources/subscriptions/resourceGroups/read (covered by Reader) |
Azure resources | GET /subscriptions then GET /subscriptions/{subscriptionId}/resources?api-version=2021-04-01 | Microsoft.Resources/subscriptions/resources/read (covered by Reader) |
Azure virtual machines | GET /subscriptions then filtered GET /subscriptions/{subscriptionId}/resources?...resourceType eq 'Microsoft.Compute/virtualMachines' | Microsoft.Resources/subscriptions/resources/read (covered by Reader) |
Azure managed clusters | GET /subscriptions then filtered GET /subscriptions/{subscriptionId}/resources?...resourceType eq 'Microsoft.ContainerService/managedClusters' | Microsoft.Resources/subscriptions/resources/read (covered by Reader) |
Azure storage accounts | GET /subscriptions then filtered GET /subscriptions/{subscriptionId}/resources?...resourceType eq 'Microsoft.Storage/storageAccounts' | Microsoft.Resources/subscriptions/resources/read (covered by Reader) |
Azure key vaults | GET /subscriptions then filtered GET /subscriptions/{subscriptionId}/resources?...resourceType eq 'Microsoft.KeyVault/vaults' | Microsoft.Resources/subscriptions/resources/read (covered by Reader) |
Practical recommendation
Assign the service principal the Reader role on each subscription you want to ingest.
If you want stricter least-privilege access, create a custom role with only the read actions listed above.
