Skip to main content
An Azure CLI account lets people run az commands as a Microsoft Entra ID service principal without handing out its client secret. When someone launches a session, Infisical gets short-lived access tokens for the service principal. Their az requests go through a Gateway, which adds the right token to each request. Azure CLI accounts only support the CLI, not browser access. Infisical records each request’s method, URL, and response body. It leaves out the bodies of Azure Key Vault requests and responses, because they can contain secret values.

​
Prerequisites

  • The Admin role on the folder you’ll add the account to
  • A Gateway that can reach the following hosts on port 443: login.microsoftonline.com, management.azure.com, graph.microsoft.com, *.vault.azure.net, and *.core.windows.net
  • Permission to register applications in Microsoft Entra ID and to assign roles on the Azure resources the account should reach
  • The Azure CLI on the machine of each person who connects

​
Create a service principal

1
In the Azure portal, go to Microsoft Entra ID > App registrations and select New registration. Enter a name, such as infisical-pam, and register the app.
2
On the app’s Overview page, copy the Application (client) ID and the Directory (tenant) ID.
3
Go to Certificates & secrets and select New client secret. Copy the secret’s Value, not its Secret ID. Azure only shows the value once.
4
Open the subscription or resource group the account should reach, go to Access control (IAM), and select Add role assignment. Choose a role, such as Reader, and on the Members tab select the app you registered.
People can only reach the Azure services that the service principal has access to. Azure Resource Manager, Key Vault, and Storage need an Azure role assignment. Microsoft Graph needs application permissions with admin consent.

​
Create an account

1
Go to Privileged Access Management > Accounts and select Add Account.
2
Select the Folder to add the account to and an Azure CLI Account Template, such as the default azure-cli template, then select Next.
3
Enter a Name for the account and the service principal’s details:
4
Select Create.

​
Connect

To learn how to launch a session, see Connect to an account. The CLI command for the account is:
The CLI opens a new shell that’s signed in to Azure as the service principal. Your own az login isn’t changed. Run az commands in that shell:
Type exit to end the session. The CLI then deletes the session’s Azure CLI configuration.