Connecting Azure

Gildyard needs two of Azure's built-in read-only roles on a subscription: Reader and Cost Management Reader. There are three ways to grant them. All three create the same two role assignments, and you can delete them at any time.

Before you start

Granting roles takes someone with Owner or User Access Administrator on the subscription in Azure. Your role in Gildyard doesn't matter for this step. Assign the roles on the subscription itself or on a management group above it: a grant on a single resource group doesn't count, because it wouldn't cover the subscription.

Every grant is labelled with your workspace's reference, ctxp:<id>, so Gildyard knows which workspace the access is for. The app shows your reference, and the exact commands with it filled in, under Connections.

One button, in the app

On Connections, press Connect a subscription. You sign in to Microsoft, which asks you to let Gildyard act as you for this one step. Gildyard lists the subscriptions you can grant on, you tick the ones you want, and it assigns the two roles on them. Then it discards the permission to act as you: it keeps it ten minutes at most, and deletes it the moment it has been used.

Many organizations require an administrator to approve an app before it can act as a user. If yours does, Azure says so, nothing is changed, and the two ways below work without that approval.

The portal template

The app offers two links, Deploy to a subscription and Deploy to a management group. Each opens a template in the Azure portal that creates the two role assignments and nothing else; the portal shows both before you select Create. A management group grant covers every subscription under it, including ones created later. The links work for 24 hours; the template itself can be read first.

Two commands

In Azure Cloud Shell (Bash) or the Azure CLI, with your subscription ID on the first line:

SUB=<your-subscription-id>
az role assignment create --role "Reader" \
  --assignee-object-id <Gildyard's object id> --assignee-principal-type ServicePrincipal \
  --scope /subscriptions/$SUB --description "Gildyard read-only access (ctxp:<id>)"
az role assignment create --role "Cost Management Reader" \
  --assignee-object-id <Gildyard's object id> --assignee-principal-type ServicePrincipal \
  --scope /subscriptions/$SUB --description "Gildyard read-only access (ctxp:<id>)"

The object ID is Gildyard's identity in your directory, and the description carries your reference; the app shows both filled in, ready to copy. For a management group, the scope is /providers/Microsoft.Management/managementGroups/<management-group-id>.

Then

Azure can take a few minutes to apply new roles. Gildyard checks what it can see, and you pick which subscriptions become yards. A yard appears within a minute or two, and Gildyard checks every 15 minutes that the grant is still there and still names your workspace. If it isn't, the yard stops and says so.

Removing Gildyard

1. Disconnect the yard in its settings. Gildyard deletes everything it stored about that subscription at once, apart from the activity log's record that it was connected and disconnected.
2. Delete the two role assignments in Azure, in the portal under the subscription's Access control (IAM), or with az role assignment delete --assignee <Gildyard's application id> --scope /subscriptions/<subscription-id>. The app's Data access page lists the exact commands for where your access was granted.

If the grant was on a management group, deleting it there takes Gildyard's access away from every subscription under that group, not only the one you disconnected.