Create an Azure service principal

In this milestone, you’ll create an Azure service principal that grants Grafana Cloud the necessary permissions to collect metrics from your Azure account. This service principal uses the principle of least privilege, providing the read-only access required for monitoring.

A service principal is an identity created for use with applications and services. In this case, the service principal allows Grafana Cloud to authenticate with Azure and read metrics data without requiring user credentials.

You’ll complete these steps in Azure Cloud Shell or a local terminal, then return to Grafana Cloud in the next milestone.

1. Open a terminal or Azure Cloud Shell, then use the Azure CLI commands below to create the service principal.

2. Log in to your Azure account:

   Bash Copy

   az login

3. List your available subscriptions to identify which subscriptions you want to monitor:

   Bash Copy

   az account list --output table

4. Create a service principal with the Monitoring Reader role for each subscription you want to monitor.

   Replace SUBSCRIPTION_ID with your Azure subscription ID:

   Bash Copy

   az ad sp create-for-rbac --name grafana-cloud-azure-metrics --role "Monitoring Reader" --scopes "/subscriptions/SUBSCRIPTION_ID"

   Note: If a service principal with this name already exists, this command updates it with the specified role and scopes.

5. Save the output of the command, which includes the credential information you need for the next milestone:

   JSON Copy

   {
     "appId": "12345678-1234-1234-1234-123456789012",
     "displayName": "grafana-cloud-azure-metrics",
     "password": "your-secret-password",
     "tenant": "87654321-4321-4321-4321-210987654321"
   }

   • appId is the Client ID
   • password is the Client secret
   • tenant is the Tenant ID

   Caution: Store the client secret securely. Azure displays this value only once during service principal creation. If you lose this value, you’ll need to create a new client secret.

6. You created a read-only Azure service principal and saved the client ID, client secret, and tenant ID for the next milestone.

In your next milestone, you’ll use this service principal to connect your Azure account to Grafana Cloud.