Azure integration

Azure support is in beta

Azure is in beta in Secorvia. Connecting a subscription follows the steps below, and the results appear in the same inventory and findings lists as every other provider. Because the support is in beta, read your first Azure scan with care. Open the inventory to see what was collected, and confirm the scan finished before you draw a conclusion from an empty or short list. The product's own advice when expected resources are missing is to check the subscription scope and the scan's completion before changing credentials.

What Secorvia reads from Azure, and what it finds

The Azure services Secorvia lists on its homepage are virtual machines, Blob storage, Active Directory, AKS and Functions. It reads how those resources are configured and how they relate to each other. It does not read what is inside them, so blob contents and application data stay where they are.

The inventory records each resource's ID, region, resource group, tags and raw metadata, and it can be filtered by subscription ID and resource group as well as by region. Each finding carries its evidence, an explanation of why it matters, remediation guidance and its compliance impact. From the Starter plan the same graph that holds your Azure resources is used to rank attack paths, and those paths can cross providers when you connect more than one. The compliance views list the CIS Azure Foundations benchmark among their frameworks, and compliance starts on the Starter plan. Attack path analysis explains how paths are built and ranked.

What connecting Azure takes

Azure uses a service principal. Before you start, have one that is authorized for the subscription you want to assess, along with its tenant ID, client ID, client secret and the subscription ID. You create the service principal in your own tenant, so you decide how narrow its access is and you can remove it whenever you like.

In Secorvia you open Cloud Accounts, choose Add Cloud Account, give the connection a recognizable name and pick Azure: Service Principal. You enter the tenant ID and client ID, which identify the directory and the application, then the client secret and the subscription ID. Use the secret value, not the secret's display name. The region is optional. Secret values are encrypted before they are stored and are not shown again after you save.

Saving the connection starts the first scan automatically. The account's detail page shows the subscription ID, tenant ID, connection status and when the connection was last validated, with links to scan history, inventory and findings scoped to that subscription. The Azure connection guide shows each screen. When a connection fails with identifiers that look right, the guide's advice is to confirm the tenant and application pairing, the secret's expiry and the permissions on the selected subscription.

Each subscription is connected as its own cloud account, so the plan's per-provider limit applies: one on Free, three on Starter, 25 on Growth and no fixed limit on Enterprise.

What Secorvia does not do on Azure

Secorvia is read-only. It never asks for write access to your infrastructure, and a read-only credential cannot change your environment. It reports problems and does not fix them, so a remediation is a change you make in Azure, followed by a new scan to confirm it.

What Secorvia can see is bounded by what you grant the service principal and by the subscription you connect, so resources outside that scope will not appear. The connection guide describes the fields and does not include a fixed role definition to assign. If your security team wants the exact permission list before approving the connection, the security page says how to ask for it. A scan is also a snapshot of the subscription at the time it ran, not a live feed.

Frequently asked questions

Is Azure support in beta?

Yes. Azure is in beta in Secorvia. Check the inventory after the first scan to see what was collected, and confirm the scan completed before relying on the results.

What credential does Azure use?

A service principal. You enter its tenant ID, client ID, client secret and the subscription ID in the Add Cloud Account form.

Does Secorvia change anything in my Azure subscription?

No. Secorvia never asks for write access. It reads configuration and metadata with a read-only credential that you create and can remove at any time.

Which Azure services does Secorvia cover?

The homepage lists virtual machines, Blob storage, Active Directory, AKS and Functions. The inventory after your first scan shows what was collected for your subscription.

How many Azure subscriptions can I connect?

One on Free, three on Starter and 25 on Growth. Enterprise has no fixed limit. Each subscription counts as one cloud account.