​
Overview

LowerPlane connects to Azure using an App Registration (service principal) with read-only permissions across your subscription and Entra ID tenant.

​
Services Monitored

​
Step 1: Open Azure Portal

Go to https://portal.azure.com/ and sign in with a Global Administrator or Application Administrator account.

​
Step 2: Create App Registration

  1. Navigate to Microsoft Entra ID
  2. Select App registrations
  3. Click New registration
Configuration:
  • Name: LowerPlane Read-Only
  • Supported account types: Single tenant (this organization only)
  • Redirect URI: Leave blank
Click Register.
Azure Register an application form with the name LowerPlane Read-Only, Single tenant selected, and an empty Redirect URI

Register an application: name the app, choose single tenant, and leave the Redirect URI blank.

​
Step 3: Create Client Secret

  1. In the app registration, go to Certificates & secrets
  2. Click New client secret
Configuration:
  • Description: lowerplane-integration
  • Expiry: 24 months (recommended)
Click Add.
Azure Certificates and secrets page showing the Client secrets tab with the New client secret button and a secret listed with Description, Expires, Value, and Secret ID columns

Certificates & secrets: the Client secrets tab, where you add the secret and copy its Value.

Important: Copy the Value column, not the Secret ID. Azure masks the Value as soon as you leave this page and will not show it again.

​
Step 4: Note Application IDs

From the app registration Overview page, copy:
  • Application (client) ID — used as Client ID in LowerPlane
  • Directory (tenant) ID — used as Tenant ID in LowerPlane

​
Step 5: Assign Subscription Reader Role

  1. Navigate to your Subscription
  2. Select Access control (IAM)
  3. Click Add role assignment
Configuration:
  • Role: Reader
  • Assign access to: User, group, or service principal
  • Select: Search for LowerPlane Read-Only (the app registration)
Click Review + assign.
Azure Add role assignment Members tab showing Selected role Reader, Assign access to User group or service principal, and the LowerPlane app added as a member of type App

Add role assignment: Reader role assigned to the app registration as a service principal.

The app registration appears under Type: App in the members list. If your search returns no results, confirm the app registration was created in the same tenant as the subscription.

​
Step 6: Add Entra ID API Permissions

  1. Go back to the App Registration
  2. Select API permissions
  3. Click Add a permission
  4. Select Microsoft Graph
  5. Select Application permissions
  6. Add the following permissions:
  1. Click Grant admin consent for [your organization]

​
Step 7: Note Subscription ID

  1. Navigate to Subscriptions in the Azure Portal
  2. Copy the Subscription ID for the subscription you want to monitor

​
Step 8: Connect in LowerPlane

  1. Go to Integrations in LowerPlane
  2. Find Microsoft Azure and click Connect
  3. Enter the following credentials:
  1. Click Connect
LowerPlane will validate the credentials and begin syncing.

​
Important Notes

  • Set a reminder to rotate the client secret before it expires (Azure does not auto-renew)
  • If your organization uses both Azure AD for identity and Azure for infrastructure, you may need two separate connections
  • The Reader role provides read-only access. LowerPlane never modifies resources in your Azure subscription

​
Automated Tests

When Azure is connected, LowerPlane automatically creates and runs tests including:
  • MFA is enforced for all users
  • Conditional access policies are configured
  • Network security groups do not allow unrestricted inbound access
  • Storage account encryption is enabled
  • Diagnostic logging is configured
  • Azure Policy compliance is monitored