Overview
This guide walks you through creating a Microsoft Entra service principal to enable the Opriven integration for Azure. Once connected, Opriven can investigate incidents across App Service, Azure SQL (Database, Elastic Pool, and Managed Instance), Storage, Service Bus, Function Apps, AKS, Container Apps, Cosmos DB, MySQL, PostgreSQL, Redis, Event Hubs, Data Explorer, and Application Insights. It queries Log Analytics (KQL), Azure Monitor metrics, Resource Health, and the Activity Log to correlate symptoms with configuration changes and deployment events.
Set up in Opriven
Go to the Azure integration setup in the Opriven dashboard.
Prerequisites
An Azure subscription you want to monitor
Permission to register applications in Microsoft Entra ID
Permission to assign roles on the target subscription (Owner or User Access Administrator)
Setup
Azure Portal
Azure CLI
1
Register an application in Entra ID
Go to the
Azure Portal
Navigate to
Microsoft Entra ID > App registrations
Click
+ New registration
Fill in:
Name:
opriven-monitoring
Supported account types:
Accounts in this organizational directory only
Click
Register
On the overview page, copy the
Application (client) ID
and
Directory (tenant) ID
2
Create a client secret
In the app registration, go to
Certificates & secrets
Click
+ New client secret
, set a description and expiration
Click
Add
Copy the secret
Value
immediately
The secret value is only shown once. Copy it before leaving the page.
3
Assign the Reader role on your subscription
For each subscription you want to monitor:
Navigate to
Subscriptions
and open the target subscription
Go to
Access control (IAM)
Click
+ Add > Add role assignment
Select the
Reader
role, then click
Next
Under
Members
, select
User, group, or service principal
, click
+ Select members
Search for
opriven-monitoring
, select it, click
Select
Click
Review + assign
, then
Review + assign
again to confirm
Copy the
Subscription ID
from the subscription overview
1
Create the service principal and assign Reader
az
ad
sp
create-for-rbac
\
--name
opriven-monitoring
\
--role
Reader
\
--scopes
/subscriptions/
<
SUBSCRIPTION_I
D
>
Output includes
appId
(client ID),
password
(client secret), and
tenant
. Save these values.
2
Assign Reader to additional subscriptions (optional)
az
role
assignment
create
\
--assignee
<
APP_I
D
>
\
--role
Reader
\
--scope
/subscriptions/
<
SUBSCRIPTION_I
D
>
Configure the Opriven integration
Navigate to the Opriven Azure integration page
Paste the
Tenant ID
,
Client ID
,
Client Secret
, and (optional) default
Subscription ID
Click
Connect
Permissions and Access
Opriven uses a read-only service principal scoped to the subscriptions you select. No write, delete, or configuration changes are performed in your Azure environment.
Role
Scope
Access
Reader
Selected subscriptions
Standard Azure built-in role. Grants
*/read
across the subscription — view all resources and their configuration, but no data-plane access (no Key Vault secrets, no Storage blob contents, no database rows) and no mutations.
Opriven uses this access to list resources, read configuration and deployment state, query Azure Monitor metrics and Log Analytics (KQL), and read the Activity Log. Queries against databases (SQL, Cosmos, MySQL, PostgreSQL, Data Explorer) and Storage blob contents are only available if you separately grant the corresponding data-plane roles — Reader alone does not enable them.
If a Log Analytics workspace uses
workspace-level access control mode
(default for workspaces created before March 2019), additionally assign the
Log Analytics Reader
role at the workspace level. Workspaces created after March 2019 default to resource-context mode and do not require this.
Credentials are stored encrypted and rotated per your Entra app’s secret expiration policy. Revoke access at any time by deleting the
opriven-monitoring
app registration or removing its role assignments.