Azure | Cloud Accounts

This page explains how to set up an Azure subscription so that ACTIVATE can manage your Azure infrastructure, clusters, billing, storage, and usage data.

The steps on this page should be completed by a cloud engineer in your organization.

Azure Subscription

We recommend creating a new Azure subscription for the ACTIVATE platform, which will allow you to keep your existing Azure subscription separate from the platform and make it easier to manage billing and usage data. This will also ensure the principle of least privilege, as ACTIVATE will only have access to the resources it needs to manage.

To learn more about Azure subscriptions, please see the Azure documentation.

Setting Up Azure Credentials

ACTIVATE authenticates as a service principal in your tenant. The service principal needs three kinds of access, all described in Azure Permissions below:

Subscription access to manage compute, networking, storage and billing resources. To get started quickly, assign the Owner role on the subscription. To limit the scope of the service principal, create the custom role below and assign it instead.
Storage data access to read the billing cost exports. No control-plane role grants this, Owner included, so also assign Storage Blob Data Reader (or Storage Blob Data Owner) on the subscription, or use the custom role below, which includes it.
Microsoft Graph permissions for temporary storage credentials and ML Studio.

Creating a Client Secret

ACTIVATE uses Azure client secrets to authenticate with Azure. You can create a new client secret by following the steps in the Azure documentation.

Azure Permissions

Permission Check

When you add the cloud account, ACTIVATE checks the service principal's effective permissions on the subscription against every action and Microsoft Graph permission listed below, and lists any that are missing. Access granted through a custom role, a management group or a group counts, and a wildcard such as Microsoft.Compute/virtualMachines/* covers the actions it matches.

pw-activate

This custom role covers every subscription action and data action ACTIVATE uses. Replace <subscription-id> with your subscription ID, save the JSON as pw-activate.json, then create the role with az role definition create --role-definition pw-activate.json and assign it to the service principal on the subscription.

{
  "Name": "pw-activate",
  "IsCustom": true,
  "Description": "Permissions ACTIVATE uses to manage infrastructure in this subscription.",
  "Actions": [
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/write",
    "Microsoft.Compute/virtualMachines/delete",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/deallocate/action",
    "Microsoft.Compute/virtualMachines/instanceView/read",
    "Microsoft.Compute/virtualMachines/extensions/write",
    "Microsoft.Compute/virtualMachineScaleSets/read",
    "Microsoft.Compute/virtualMachineScaleSets/write",
    "Microsoft.Compute/virtualMachineScaleSets/delete",
    "Microsoft.Compute/virtualMachineScaleSets/delete/action",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/ipConfigurations/read",
    "Microsoft.Compute/disks/read",
    "Microsoft.Compute/disks/write",
    "Microsoft.Compute/disks/delete",
    "Microsoft.Compute/snapshots/read",
    "Microsoft.Compute/snapshots/write",
    "Microsoft.Compute/snapshots/delete",
    "Microsoft.Compute/images/read",
    "Microsoft.Compute/galleries/read",
    "Microsoft.Compute/galleries/write",
    "Microsoft.Compute/galleries/delete",
    "Microsoft.Compute/galleries/images/read",
    "Microsoft.Compute/galleries/images/write",
    "Microsoft.Compute/galleries/images/delete",
    "Microsoft.Compute/galleries/images/versions/read",
    "Microsoft.Compute/galleries/images/versions/write",
    "Microsoft.Compute/galleries/images/versions/delete",
    "Microsoft.Compute/skus/read",
    "Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/versions/read",
    "Microsoft.MarketplaceOrdering/offerTypes/publishers/offers/plans/agreements/read",
    "Microsoft.Network/virtualNetworks/read",
    "Microsoft.Network/virtualNetworks/write",
    "Microsoft.Network/virtualNetworks/delete",
    "Microsoft.Network/virtualNetworks/join/action",
    "Microsoft.Network/virtualNetworks/subnets/read",
    "Microsoft.Network/virtualNetworks/subnets/write",
    "Microsoft.Network/virtualNetworks/subnets/join/action",
    "Microsoft.Network/networkInterfaces/read",
    "Microsoft.Network/networkInterfaces/write",
    "Microsoft.Network/networkInterfaces/delete",
    "Microsoft.Network/networkInterfaces/join/action",
    "Microsoft.Network/publicIPAddresses/read",
    "Microsoft.Network/publicIPAddresses/write",
    "Microsoft.Network/publicIPAddresses/delete",
    "Microsoft.Network/publicIPAddresses/join/action",
    "Microsoft.Network/networkSecurityGroups/read",
    "Microsoft.Network/networkSecurityGroups/write",
    "Microsoft.Network/networkSecurityGroups/delete",
    "Microsoft.Network/networkSecurityGroups/join/action",
    "Microsoft.Network/natGateways/read",
    "Microsoft.Network/natGateways/write",
    "Microsoft.Network/natGateways/delete",
    "Microsoft.Network/natGateways/join/action",
    "Microsoft.Network/privateEndpoints/read",
    "Microsoft.Network/privateEndpoints/write",
    "Microsoft.Network/privateEndpoints/delete",
    "Microsoft.Network/privateDnsZones/read",
    "Microsoft.Network/privateDnsZones/write",
    "Microsoft.Network/privateDnsZones/delete",
    "Microsoft.Network/privateDnsZones/A/read",
    "Microsoft.Network/privateDnsZones/A/write",
    "Microsoft.Network/privateDnsZones/A/delete",
    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/delete",
    "Microsoft.Network/loadBalancers/read",
    "Microsoft.Network/loadBalancers/write",
    "Microsoft.Network/loadBalancers/delete",
    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
    "Microsoft.Storage/checkNameAvailability/read",
    "Microsoft.Storage/storageAccounts/read",
    "Microsoft.Storage/storageAccounts/write",
    "Microsoft.Storage/storageAccounts/delete",
    "Microsoft.Storage/storageAccounts/listKeys/action",
    "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
    "Microsoft.Storage/storageAccounts/blobServices/write",
    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
    "Microsoft.Storage/storageAccounts/fileServices/write",
    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
    "Microsoft.Storage/storageAccounts/fileServices/shares/write",
    "Microsoft.Resources/subscriptions/read",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Resources/subscriptions/resourceGroups/write",
    "Microsoft.Resources/subscriptions/resourceGroups/delete",
    "Microsoft.Resources/subscriptions/providers/read",
    "Microsoft.Authorization/roleAssignments/read",
    "Microsoft.Authorization/roleAssignments/write",
    "Microsoft.Authorization/roleAssignments/delete",
    "Microsoft.Authorization/roleDefinitions/read",
    "Microsoft.NetApp/register/action",
    "Microsoft.NetApp/netAppAccounts/read",
    "Microsoft.NetApp/netAppAccounts/write",
    "Microsoft.NetApp/netAppAccounts/delete",
    "Microsoft.NetApp/netAppAccounts/capacityPools/read",
    "Microsoft.NetApp/netAppAccounts/capacityPools/write",
    "Microsoft.NetApp/netAppAccounts/capacityPools/delete",
    "Microsoft.NetApp/netAppAccounts/capacityPools/volumes/read",
    "Microsoft.NetApp/netAppAccounts/capacityPools/volumes/write",
    "Microsoft.NetApp/netAppAccounts/capacityPools/volumes/delete",
    "Microsoft.StorageCache/register/action",
    "Microsoft.StorageCache/checkAmlFSSubnets/action",
    "Microsoft.StorageCache/amlFilesystems/read",
    "Microsoft.StorageCache/amlFilesystems/write",
    "Microsoft.StorageCache/amlFilesystems/delete",
    "Microsoft.MachineLearningServices/register/action",
    "Microsoft.MachineLearningServices/workspaces/read",
    "Microsoft.MachineLearningServices/workspaces/write",
    "Microsoft.MachineLearningServices/workspaces/delete",
    "Microsoft.KeyVault/vaults/read",
    "Microsoft.KeyVault/vaults/write",
    "Microsoft.KeyVault/vaults/delete",
    "Microsoft.Insights/components/read",
    "Microsoft.Insights/components/write",
    "Microsoft.Insights/components/delete",
    "Microsoft.CognitiveServices/accounts/read",
    "Microsoft.CognitiveServices/accounts/write",
    "Microsoft.CognitiveServices/accounts/delete",
    "Microsoft.CognitiveServices/accounts/listKeys/action",
    "Microsoft.CognitiveServices/accounts/deployments/read",
    "Microsoft.CognitiveServices/accounts/deployments/write",
    "Microsoft.CognitiveServices/accounts/deployments/delete",
    "Microsoft.CognitiveServices/locations/resourceGroups/deletedAccounts/delete",
    "Microsoft.Search/searchServices/read",
    "Microsoft.Search/searchServices/write",
    "Microsoft.Search/searchServices/delete",
    "Microsoft.Search/searchServices/listAdminKeys/action",
    "Microsoft.CostManagementExports/register/action",
    "Microsoft.CostManagement/register/action",
    "Microsoft.CostManagement/exports/read",
    "Microsoft.CostManagement/exports/write",
    "Microsoft.CostManagement/exports/delete"
  ],
  "NotActions": [],
  "DataActions": [
    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
  ],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/<subscription-id>"
  ]
}

Microsoft Graph

Add these application permissions to the service principal's app registration under API permissions > Microsoft Graph, then grant admin consent. Each row needs one of the listed permissions.

Used for	Permission
Temporary storage credentials	`Application.ReadWrite.OwnedBy` or `Application.ReadWrite.All`
ML Studio sign-in user	`User.ReadWrite.All`
ML Studio tenant domains	`Domain.Read.All`, `Directory.Read.All` or `Directory.ReadWrite.All`