Azure Ecosystem

Connect your Azure subscriptions so Darcy can answer questions about your resources, spend, and recommendations in natural language

Connect Microsoft Azure to DarcyIQ and your subscriptions become something you can ask questions about. Darcy queries Azure Resource Manager directly — discovering resources, analyzing spend, and reading Advisor recommendations — using a Microsoft Entra app registration you control.

Available Integrations

Infrastructure & Operations

• Azure Subscriptions Integration — Direct access to your Azure subscriptions for real-time cloud intelligence

Other Clouds

• AWS Ecosystem — The equivalent integration for AWS accounts

Key Capabilities

Capability	What it means
Resource Discovery	One Azure Resource Graph query spans every connected subscription and region at once — no per-region hunting
Cost Analysis	Cost Management queries for spend by service, resource group, location, or day
Recommendations	Azure Advisor recommendations for cost, security, reliability, and performance
Any ARM Operation	Beyond the shortcuts, Darcy can call any Azure Resource Manager operation your role permits
Provider Discovery	Darcy finds the right resource provider, resource type, and API version on its own

Security Model

Azure integrations in DarcyIQ are built so that Azure decides what Darcy can do — not DarcyIQ:

• Microsoft Entra app registration — you create it, you own it, and you can revoke it at any time

• Your role assignment is the boundary — assign Reader and every write attempt comes back from Azure as AuthorizationFailed. There is no DarcyIQ setting that can widen this

• Subscription allow-list — the integration only reaches the subscription IDs you list; anything else is refused before a call is made

• Credential-returning operations are always refused — listKeys, listSecrets, and listConnectionStrings are blocked regardless of role, because their responses are reusable secrets

• Secret expiry tracking — record your client secret's expiry date and DarcyIQ warns you before it lapses

Grant Reader first. Add Cost Management Reader if you want spend analysis. Only grant Contributor if you actually want Darcy to create, update, and delete Azure resources.

Prerequisites

1. An Azure subscription, and permission to create an app registration in Microsoft Entra ID

2. Permission to assign roles on each subscription you want to connect (Access control / IAM)

3. The subscription IDs you intend to connect

4. A clear internal policy on whether Darcy should have write access

Next Steps

Goal	Documentation
Connect your subscriptions and start asking questions	Azure Subscriptions Integration
Do the same for AWS	AWS Accounts Integration
Control which tools agents may use	Tool Permissions
See every available integration	Integration Catalog