Guide
Connect Azure
About 5 minutes in the Azure portal, or one command with the Azure CLI. VizTopo signs in to Azure as an app registration of its own, with the Reader role on one subscription: it reads the VMs, virtual networks, subnets, network security groups, disks, public IPs and load balancers, with their prices, and changes nothing. The client secret is stored encrypted on the server and never sent back to your browser.
1. Create an app registration and a client secret
In the Azure portal: Microsoft Entra ID → App registrations → New registration. Name it viztopo-reader, keep Single tenant, and choose Register. On its Overview, note the Application (client) ID and the Directory (tenant) ID.
Then Certificates & secrets → Client secrets → New client secret: pick when it expires and choose Add. Copy its Value right away: Azure shows it only once (not its Secret ID).
2. Give it the Reader role on the subscription
Open Subscriptions and the subscription VizTopo should read, and note its Subscription ID. Then Access control (IAM) → Add → Add role assignment: role Reader, Next, Select members, pick viztopo-reader, and Review + assign.
Or do both steps at once with the Azure CLI, signed in as someone who may create apps and assign roles on the subscription. It prints the client ID (appId), the client secret (password) and the tenant.
az ad sp create-for-rbac --name viztopo-reader --role Reader --scopes /subscriptions/<subscription-id>
3. Add the connection
In VizTopo: Connections → Add connection → Microsoft Azure → Guide me. Paste the tenant ID, client ID, subscription ID and the secret's Value, and Test connection: it signs in, reads the subscription, lists its VMs and checks what the app may read. Nothing is saved until you choose Save connection. One connection reads one subscription: add another for each.
Questions
Can VizTopo change anything in Azure?
No. The Reader role only reads, and VizTopo has no actions for Azure yet: Azure connections have no write mode.
Does VizTopo keep the client secret?
Yes, encrypted with AES-256-GCM on the server, so it can keep reading. It's never sent back to your browser and never logged. Delete the secret in Azure, or remove the connection, to stop it.
Where do the prices come from?
Azure's public retail price list (pay-as-you-go, in US dollars): VM sizes, managed disks by tier and public IPs. Reserved instances, savings plans and your own discounts aren't included.
Updated