Microsoft Azure
Thinfinity® Cloud Manager connects to Microsoft Azure using a Service Principal — an application identity registered in Microsoft Entra ID (formerly Azure Active Directory) with a client secret and scoped RBAC permissions on the target subscription. This article documents the Cloud Manager credential form for Azure, the minimum RBAC roles the Service Principal must have, and common configuration errors.
All API calls from Cloud Manager originate from the Thinfinity® Workspace server. Ensure outbound HTTPS (port 443) is open from that host to Azure Resource Manager (management.azure.com) and Microsoft Entra ID (login.microsoftonline.com). See Prerequisites for the full network requirements.
Prerequisites
Before adding Azure credentials in Cloud Manager, the following must be in place on the Azure side:
- An active Azure subscription with at least one resource group containing VM resources.
- A Service Principal registered in Microsoft Entra ID for Cloud Manager, with a generated Client Secret. Note the secret value — it is shown only once at creation.
- The four identifiers the credential form requires: Subscription ID, Tenant ID, Client ID, and the Client Secret value.
- The Service Principal must be assigned the RBAC roles listed in Minimum RBAC Roles below, on the target subscription or resource group.
- The Azure account performing the role assignment must have Owner or User Access Administrator rights on the subscription.
For how to register a Service Principal, generate a client secret, and assign roles, refer to the Microsoft Entra ID documentation.
Minimum RBAC Roles
The Service Principal must be granted the following Azure RBAC roles. Scope them to the subscription or, preferably, to the smallest set of resource groups that Cloud Manager needs to operate on.
| Role | Required For |
|---|---|
| Virtual Machine Contributor | All operations — list, start, stop, deallocate VMs, and create new VMs from images |
| Network Contributor | VDI/DaaS Models only — when custom Terraform templates create virtual networks or public IPs |
| Storage Account Contributor | VDI/DaaS Models only — when custom Terraform templates create storage accounts |
For Managed VMs and for VDI/DaaS Models that deploy into pre-existing networking and storage, Virtual Machine Contributor alone is sufficient. The additional roles are required only when your VDI/DaaS Model templates provision networking or storage as part of the deployment.
Authentication Method
Cloud Manager authenticates to Azure exclusively via the four Service Principal fields (Subscription ID, Tenant ID, Client ID, Client Secret). Managed Identity, Workload Identity Federation, and federated credentials are not currently supported — even when the Thinfinity Workspace server runs as an Azure VM, a registered Service Principal with a client secret is still required.
Add the Credentials in Cloud Manager
- In Cloud Manager, go to Credentials and click + New.
- Select Azure as the provider.
- Fill in the fields below and click Save.
For the full Add / Edit / Delete procedure, see Managing Credentials.
Azure Credential Fields
The Subscription, Client ID, and Tenant ID fields all expect a GUID in the format xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, where each x is a lowercase letter or a number. Cloud Manager validates the format client-side and rejects values that don’t match.
| Field | Description |
|---|---|
| Subscription | The Subscription ID of the Azure subscription that contains your VM resources. |
| Client ID | The Application (client) ID of the Service Principal. |
| Client Secret | The client secret value generated for the Service Principal. Used by Cloud Manager to authenticate. |
| Tenant ID | The Directory (tenant) ID of your Microsoft Entra ID instance. |
Verification
After saving, Cloud Manager validates the credentials by listing VMs in the target subscription via the Azure Resource Manager API. If validation succeeds, the credential status shows as Ok. If it fails, review the error and refer to Common Errors below.
Common Errors
| Error | Likely Cause | Resolution |
|---|---|---|
AADSTS70011: Invalid scope |
Incorrect Tenant ID or Client ID. | Verify both values in the Service Principal’s overview page in the Azure portal. |
AADSTS7000215: Invalid client secret |
The secret has expired or was entered incorrectly. | Generate a new client secret in the Service Principal’s Certificates & secrets section and update the credential in Cloud Manager. |
AuthorizationFailed |
The Service Principal lacks the required RBAC role on the subscription. | Verify the role assignment in the subscription’s Access control (IAM) view against the Minimum RBAC Roles table. |
SubscriptionNotFound |
The Subscription ID is incorrect or the subscription is disabled. | Confirm the Subscription ID in the Azure portal. |
| Connection timeout | The Workspace server cannot reach management.azure.com:443 or login.microsoftonline.com:443. |
Check firewall and proxy settings. See Prerequisites. |
Security Recommendations
- Set a secret expiration policy. Azure client secrets can expire. Set a calendar reminder to rotate before expiry — expired secrets cause Cloud Manager to lose connectivity without warning.
- Scope the role to a resource group, not the full subscription, when all Cloud Manager VMs reside in a single resource group. This limits the blast radius if credentials are compromised.
- Monitor Service Principal activity using Azure Monitor and Microsoft Entra sign-in logs to audit all API calls made by Cloud Manager.
See Also