# Azure Resources

> Learn how to get started with Azure Resource pre-built Data Sources for the Roadie Context Store.

*Published: 2026-05-25T12:00:00.0Z*



## Introduction

The Context Store has several Azure Resources templated Data Sources to allow users to quickly pull relevant data into their Data Store.

These templates are a starting point and often you'll want to apply filters or chained Data Sources to modify these templates to suit your needs.

## Authentication

The Azure Resource Integration shares configuration with Microsoft Graph.

It requires an application to be setup within your Microsoft instance.

Tenant ID, Client ID and Client secret are required to authenticate calls to retrieve resources.

## Pre-built Data Sources

This table lists the Azure Resource Manager (ARM) **read permissions** needed for the Azure data source seeds currently defined in this repo.

| Data source seed | ARM endpoint(s) used | Required permission / role |
| --- | --- | --- |
| `Azure subscriptions` | `GET /subscriptions?api-version=2022-12-01` | Tenant-level ability to enumerate subscriptions (commonly covered by `Reader` on each target subscription) |
| `Azure resource groups` | `GET /subscriptions` then `GET /subscriptions/{subscriptionId}/resourcegroups?api-version=2022-09-01` | `Microsoft.Resources/subscriptions/resourceGroups/read` (covered by `Reader`) |
| `Azure resources` | `GET /subscriptions` then `GET /subscriptions/{subscriptionId}/resources?api-version=2021-04-01` | `Microsoft.Resources/subscriptions/resources/read` (covered by `Reader`) |
| `Azure virtual machines` | `GET /subscriptions` then filtered `GET /subscriptions/{subscriptionId}/resources?...resourceType eq 'Microsoft.Compute/virtualMachines'` | `Microsoft.Resources/subscriptions/resources/read` (covered by `Reader`) |
| `Azure managed clusters` | `GET /subscriptions` then filtered `GET /subscriptions/{subscriptionId}/resources?...resourceType eq 'Microsoft.ContainerService/managedClusters'` | `Microsoft.Resources/subscriptions/resources/read` (covered by `Reader`) |
| `Azure storage accounts` | `GET /subscriptions` then filtered `GET /subscriptions/{subscriptionId}/resources?...resourceType eq 'Microsoft.Storage/storageAccounts'` | `Microsoft.Resources/subscriptions/resources/read` (covered by `Reader`) |
| `Azure key vaults` | `GET /subscriptions` then filtered `GET /subscriptions/{subscriptionId}/resources?...resourceType eq 'Microsoft.KeyVault/vaults'` | `Microsoft.Resources/subscriptions/resources/read` (covered by `Reader`) |

## Practical recommendation

Assign the service principal the **Reader** role on each subscription you want to ingest.  
If you want stricter least-privilege access, create a custom role with only the read actions listed above.