Microsoft Azure#

Collects Azure Monitor metrics, resource inventory via Resource Graph, and spend via Cost Management. Access is through a service principal.

Create a service principal#

In the Azure portal, or with the CLI:

az ad sp create-for-rbac \
  --name "observeiq-readonly" \
  --role "Monitoring Reader" \
  --scopes /subscriptions/YOUR_SUBSCRIPTION_ID

The output gives you the four values ObserveIQ needs:

Output field	ObserveIQ field
`tenant`	Directory (tenant) ID
`appId`	Application (client) ID
`password`	Client secret
(the subscription you scoped to)	Subscription ID

Warning

The client secret is shown once. Note its expiry date as well: Azure secrets expire, and when one does the integration stops collecting. Set a calendar reminder before the expiry.

Assign roles#

Role	Needed for
Monitoring Reader	Metrics from Azure Monitor
Reader	Resource inventory via Resource Graph
Cost Management Reader	Spend data

Assign at subscription scope, or at management group scope to cover several subscriptions at once:

az role assignment create --assignee YOUR_APP_ID \
  --role "Cost Management Reader" \
  --scope /subscriptions/YOUR_SUBSCRIPTION_ID

Add the integration#

Integrations → Azure → Add account, then paste the tenant ID, client ID, client secret and subscription ID. Save. ObserveIQ validates the credentials immediately and will not store them if they do not work.

Choose services#

Select the resource types to collect. Typical selections:

Compute: Virtual Machines, Virtual Machine Scale Sets, App Service
Containers: Azure Kubernetes Service, Container Instances
Data: Azure SQL Database, Cosmos DB, Cache for Redis, Storage Accounts
Networking: Application Gateway, Load Balancer, Front Door
Integration: Service Bus, Event Hubs, Functions

Multiple subscriptions#

Two options. Add each subscription as its own integration, which keeps them clearly separated. Or assign the service principal at management group scope and add one integration, which is less administration but mixes subscriptions together.

Azure SQL#

Azure SQL metrics arrive through Azure Monitor: DTU or vCore utilisation, connections, deadlocks and storage. For query-level detail such as blocking chains and wait statistics, also connect the database directly as a SQL data source. Azure Monitor does not expose that depth.

Verify#

Open Cloud → Explorer and filter to Azure. If resources are listed but metric panels are empty, the service principal most likely has Reader but not Monitoring Reader. They are separate roles and inventory works without the second one, which makes this easy to miss.