Docs / Clouds

Microsoft Azure

Connect an Azure subscription with workload identity federation, with no client secret to store or rotate.

Pangea reaches Azure through OIDC workload identity federation. You register an app in Entra ID, add a federated credential that trusts the Pangea issuer, and give that app an RBAC role on the subscription. Pangea mints a short-lived token for your team and exchanges it at Entra for an Azure Resource Manager access token.

No client secret is created, pasted or stored. The token is the credential. Pangea stores only three GUIDs: tenant, client and subscription.

Connect

The dialog in Connectors → Connect → Azure walks through these steps. If the Azure CLI (az) is installed on your Mac, the dialog also offers a guided setup where the agent runs it for you.

1. Register the app and federated credential

In the Azure portal, open Entra ID → App registrations → New registration. Name it Pangea, single tenant, no redirect URI, then click Register.

Open the app, then Manage → Certificates & secrets → Federated credentials → Add credential, and pick the scenario Other issuer:

Then collect two IDs. The last step asks for both:

• The app's Application (client) ID, from the app's Overview page.
• Your Directory (tenant) ID, from Microsoft Entra ID → Overview.

2. Assign a role on the subscription

Open Subscriptions → your subscription → Access control (IAM) → Add role assignment.

1. On the Role tab, pick Reader to browse, or a broader role for the work you want done, for example Azure Kubernetes Service Cluster User Role for AKS.
2. On the Members tab, choose User, group, or service principal, then + Select members. The panel stays empty until you type. Search for Pangea to find the app you registered, pick it, and click Select.
3. Click Review + assign. Then open the subscription's Overview and copy its Subscription ID.

Start least-privilege and widen later. The role scopes exactly what Pangea can see and do.

3. Bind the subscription

Back in Pangea, enter a label and the tenant, client and subscription IDs. Pangea exchanges a token and reads the subscription before it saves. A mismatched federated credential or a missing role assignment is rejected right there.

In the Pangea app

• Apps: the apps bound under this subscription, and the RBAC role assignments of each. This is the readout of what the connection can actually do.
• Clusters: AKS clusters in the subscription appear in the shared cluster browser, next to EKS, GKE and the rest.

What the agent can do for you

The agent operates the subscription through Azure Resource Manager, within the role you assigned. It inspects resources, correlates them with your other connected accounts and proposes changes as plans.

Missing cloud permissions

If Azure returns an AuthorizationFailed error, verify the subscription and app identity first. Then have an authorized administrator add the narrowest missing RBAC assignment. The agent can help through a selected computer's already authorized local CLI. See Cloud permission errors.

Permissions and authorization

• The RBAC role you assigned is the outer limit. Assign Reader if you only want the agent to look.
• Hard boundary: who can use it. Only team Administrators can bind or remove the subscription. They can restrict it to specific members with a member allow-list.
• Soft boundary: what the agent may do with it. Significant cloud changes use plans. Individual actions follow Auto Mode and Full Access.

Good to know

• Entra fetches the issuer's signing keys itself. There is no public key to paste and nothing to rotate on your side.
• The federated credential is pinned to your team's subject. Another Pangea team's token cannot satisfy it. See the IAM trust model.