> For the complete documentation index, see [llms.txt](https://docs.darcyiq.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.darcyiq.com/build/integration-overview/azure.md).

# Azure Ecosystem

Connect your Azure subscriptions so Darcy can answer questions about your resources, spend, and recommendations in natural language

Connect Microsoft Azure to DarcyIQ and your subscriptions become something you can ask questions about. Darcy queries Azure Resource Manager directly — discovering resources, analyzing spend, and reading Advisor recommendations — using a Microsoft Entra app registration you control.

## Available Integrations

### Infrastructure & Operations

* [**Azure Subscriptions Integration**](/build/integration-overview/azure/azure-api.md) — Direct access to your Azure subscriptions for real-time cloud intelligence

### Other Clouds

* [**AWS Ecosystem**](/build/integration-overview/aws.md) — The equivalent integration for AWS accounts

## Key Capabilities

| Capability             | What it means                                                                                                |
| ---------------------- | ------------------------------------------------------------------------------------------------------------ |
| **Resource Discovery** | One Azure Resource Graph query spans every connected subscription and region at once — no per-region hunting |
| **Cost Analysis**      | Cost Management queries for spend by service, resource group, location, or day                               |
| **Recommendations**    | Azure Advisor recommendations for cost, security, reliability, and performance                               |
| **Any ARM Operation**  | Beyond the shortcuts, Darcy can call any Azure Resource Manager operation your role permits                  |
| **Provider Discovery** | Darcy finds the right resource provider, resource type, and API version on its own                           |

## Security Model

Azure integrations in DarcyIQ are built so that **Azure decides what Darcy can do** — not DarcyIQ:

* **Microsoft Entra app registration** — you create it, you own it, and you can revoke it at any time
* **Your role assignment is the boundary** — assign `Reader` and every write attempt comes back from Azure as `AuthorizationFailed`. There is no DarcyIQ setting that can widen this
* **Subscription allow-list** — the integration only reaches the subscription IDs you list; anything else is refused before a call is made
* **Credential-returning operations are always refused** — `listKeys`, `listSecrets`, and `listConnectionStrings` are blocked regardless of role, because their responses are reusable secrets
* **Secret expiry tracking** — record your client secret's expiry date and DarcyIQ warns you before it lapses

{% hint style="info" %}
**Grant `Reader` first.** Add `Cost Management Reader` if you want spend analysis. Only grant `Contributor` if you actually want Darcy to create, update, and delete Azure resources.
{% endhint %}

## Prerequisites

1. An Azure subscription, and permission to create an app registration in Microsoft Entra ID
2. Permission to assign roles on each subscription you want to connect (Access control / IAM)
3. The subscription IDs you intend to connect
4. A clear internal policy on whether Darcy should have write access

## Next Steps

| Goal                                                  | Documentation                                                                     |
| ----------------------------------------------------- | --------------------------------------------------------------------------------- |
| Connect your subscriptions and start asking questions | [Azure Subscriptions Integration](/build/integration-overview/azure/azure-api.md) |
| Do the same for AWS                                   | [AWS Accounts Integration](/build/integration-overview/aws/aws-api.md)            |
| Control which tools agents may use                    | [Tool Permissions](/build/integration-overview/tool-permissions.md)               |
| See every available integration                       | [Integration Catalog](/build/integration-overview/integration-catalog.md)         |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.darcyiq.com/build/integration-overview/azure.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.