Connect Azure to SubImage

What this does

Registers an application in Microsoft Entra (Azure AD), creates a service principal, generates a client secret, and grants Reader on the subscriptions to scan. Walks two paths: Terraform and az CLI. A third, one-time delegated sync covers tenants that can't create a service principal at all.

When to use

✅ User wants to onboard one or more Azure subscriptions, or a Management Group root, into SubImage. ✅ User asks for the Azure service principal, role assignment, or Terraform for SubImage scanning. ✅ User is in their IaC repo and wants the Azure setup committed as code.

❌ User wants Entra ID (users, groups, sign-ins) or Intune coverage: this skill only covers the Azure resource plane. Add the microsoft module on top. ❌ User wants to scan AKS at the cluster layer: Reader on the subscription gives metadata only; for in-cluster RBAC, use a separate Kubernetes path.

Required inputs

Before running anything, collect these. If any are missing, ask the user explicitly. For the one-time delegated sync, only the tenant ID is needed; skip the subscription and Management Group rows.