> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure CLI accounts

> Give people Azure CLI access to Azure as a service principal.

An Azure CLI account lets people run `az` commands as a Microsoft Entra ID service principal without handing out its client secret. When someone launches a session, Infisical gets short-lived access tokens for the service principal. Their `az` requests go through a [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md), which adds the right token to each request. Azure CLI accounts only support the CLI, not browser access.

Infisical records each request's method, URL, and response body. It leaves out the bodies of Azure Key Vault requests and responses, because they can contain secret values.

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* A Gateway that can reach the following hosts on port `443`: `login.microsoftonline.com`, `management.azure.com`, `graph.microsoft.com`, `*.vault.azure.net`, and `*.core.windows.net`
* Permission to register applications in Microsoft Entra ID and to assign roles on the Azure resources the account should reach
* The [Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli) on the machine of each person who connects

## Create a service principal

**Step 1**

In the Azure portal, go to **Microsoft Entra ID** > **App registrations** and select **New registration**. Enter a name, such as `infisical-pam`, and register the app.

**Step 2**

On the app's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**.

**Step 3**

Go to **Certificates & secrets** and select **New client secret**. Copy the secret's **Value**, not its **Secret ID**. Azure only shows the value once.

**Step 4**

Open the subscription or resource group the account should reach, go to **Access control (IAM)**, and select **Add role assignment**. Choose a role, such as **Reader**, and on the **Members** tab select the app you registered.

People can only reach the Azure services that the service principal has access to. Azure Resource Manager, Key Vault, and Storage need an Azure role assignment. Microsoft Graph needs application permissions with admin consent.

## Create an account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** to add the account to and an Azure CLI **Account Template**, such as the default `azure-cli` [template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md), then select **Next**.

**Step 3**

Enter a **Name** for the account and the service principal's details:

| Field | Description |
| - | - |
| **Tenant ID** | The directory (tenant) ID, or a domain such as `contoso.onmicrosoft.com` |
| **Subscription ID** | The subscription that `az` uses by default during a session (optional) |
| **Gateway** | The Gateway that connects to Azure (only shown if the template doesn't set one) |
| **Client ID** | The application (client) ID |
| **Client Secret** | The client secret value |

**Step 4**

Select **Create**.

## Connect

To learn how to launch a session, see [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md). The CLI command for the account is:

```bash theme={"dark"}
infisical pam access <folder>/<account>
```

The CLI opens a new shell that's signed in to Azure as the service principal. Your own `az` login isn't changed. Run `az` commands in that shell:

```bash theme={"dark"}
az group list
```

Type `exit` to end the session. The CLI then deletes the session's Azure CLI configuration.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.