Azure

Trustle reads subscriptions, resource groups, Azure role definitions and role assignments, PIM eligible and active roles, activity logs, management groups, and Azure AI Foundry agents from Azure. Trustle can assign and remove Azure roles at the subscription scope.

Prerequisites

• The app registration from the Microsoft Entra ID page, Steps 1 to 3. Azure uses the same app, client secret, and Microsoft Graph permissions. Test Connection reads Entra users, so the Graph permissions are required.
• The Owner or User Access Administrator role on each subscription. Only these roles can create a custom role and assign it.
• Microsoft Entra ID P2, only for PIM roles. Without it, Trustle shows no PIM eligible or active roles.
• An identity provider connected in Trustle, for example Okta or Microsoft Entra ID. Trustle hides Cloud Providers until one is connected.

Configure Azure

Step 1: Create a custom role

1. In the Azure portal, search for Subscriptions and open the subscription.

   

2. Go to Access control (IAM). Click Add, then Add a custom role.

   

3. Enter a name, for example Trustle IAM Manager. Select Start from scratch. Click Next.

   

4. Click Add permissions.

   

5. Search for and select Microsoft.Authorization.

   

6. Select the Microsoft.Authorization permissions from the table below.

   

7. Search for Microsoft.Resources and Microsoft Azure Monitor. Select their permissions from the table:

   Permission	Required	What Trustle does with it
   Microsoft.Authorization/roleDefinitions/read	Yes	Imports built-in and custom Azure roles.
   Microsoft.Authorization/roleAssignments/read	Yes	Imports who has each role.
   Microsoft.Authorization/roleAssignments/write	Optional	Assigns Azure roles. Without it, Trustle cannot grant a role.
   Microsoft.Authorization/roleAssignments/delete	Optional	Removes Azure roles. Without it, Trustle cannot revoke a role.
   Microsoft.Authorization/roleEligibilityScheduleInstances/read	Yes	Imports PIM eligible roles. Needs Microsoft Entra ID P2.
   Microsoft.Authorization/roleAssignmentScheduleInstances/read	Yes	Imports active PIM roles. Needs Microsoft Entra ID P2.
   Microsoft.Resources/subscriptions/read	Yes	Finds the subscription.
   Microsoft.Resources/subscriptions/resourceGroups/read	Yes	Imports resource groups.
   Microsoft.Insights/eventtypes/values/read	Yes	Reads the last 30 days of activity logs to find roles that nobody uses.

8. Click Add, then Review + create, then Create.

Step 2: Assign the role in each subscription

Trustle reads only the subscriptions where the app has this role. Do these steps in each subscription.

1. In the subscription, go to Access control (IAM). Click Add, then Add role assignment.
2. Select Privileged administrator roles. Select Trustle IAM Manager. Click Next.
3. Click Select members and select the Trustle app registration.
4. On the Conditions tab, select Allow user to assign all roles (highly privileged).
5. Click Review + assign two times.
6. On Access control (IAM) → Role assignments, check that the app has Trustle IAM Manager.

Step 3: Let Trustle read management groups (optional)

1. Go to Management groups and open the tenant root group.
2. Assign the Management Group Reader role to the Trustle app registration.

Without this role, Trustle shows no management groups. The rest of the sync is not affected.

Step 4: Let Trustle find Foundry agents (optional)

Do this step only if you run agents in Azure AI Foundry. Trustle shows each agent with its own identity as a principal, and you can enable it in Trustle.

A Foundry resource is the top-level Azure resource that holds your Foundry projects and their agents. It is not a project. In Azure, its type is Microsoft.CognitiveServices/accounts and its kind is AIServices. Trustle does not show agents in hub-based projects.

Assign the Foundry User role (formerly Azure AI User) to the Trustle app registration. With this role, Trustle lists the Foundry resources and their projects, and reads the agents in each project.

1. Open the scope for the role assignment:
   • The resource group or the subscription, to cover all of its Foundry resources. This scope also covers Foundry resources that you create later.
   • One Foundry resource, to cover only that resource.
2. Go to Access control (IAM). Click Add, then Add role assignment.
3. Select Foundry User. Click Next.
4. Click Select members and select the Trustle app registration.
5. Click Review + assign two times.

Foundry agents also need version 2 tokens to sign in to Trustle:

1. In the app registration, open Manifest.
2. Set api.requestedAccessTokenVersion to 2.
3. Click Save.

Without this role, Trustle shows no Foundry agents and shows no error. The rest of the sync is not affected. Trustle checks the token version with Application.Read.All from the Microsoft Entra ID page.

Step 5: Collect the values for Trustle

These are the values from the Microsoft Entra ID app registration.

Trustle field	Where to find it in Entra ID	Example
Client ID	App Overview → Application (client) ID	abcdef12-3456-7890-abcd-ef1234567890
Client Secret	Certificates & secrets → the secret Value	abc8Q~…
Tenant ID	App Overview → Directory (tenant) ID	12345678-1234-1234-1234-123456789012

Connect in Trustle

If you already connected Microsoft Entra ID with this app registration, skip this section. That connection reads Azure too. Trustle shows the Azure data after the next sync.

1. In Trustle, go to Connections.
2. Under Cloud Providers, find Azure and click Connect.
3. Enter a Connection Name, for example Azure production. Description is optional.
4. Enter the values from Step 5. Leave Workspace ID (Optional) empty. Trustle does not use it.
5. Select Use as Identity Provider only if Entra ID is the source of your users. Trustle allows one identity provider at a time.
6. Click Test Connection.
7. After the test passes, click Save Connection.

Note

Test Connection checks that Trustle can sign in to Microsoft Graph and read one user. It does not check the Azure role. A missing role assignment still passes. Do the steps in Verify after the first sync.

Verify

1. On the Connections page, open the connection.
2. Wait for the first sync to finish.
3. Check that the subscription count matches the subscriptions where you assigned Trustle IAM Manager.
4. Check that the role assignments of one subscription match Access control (IAM) → Role assignments in Azure.
5. If you did Step 4, go to Agents. Check that your Foundry agents are in the list.

If something is missing, see Troubleshooting.

Security notes

Note

• Use a dedicated app registration for Trustle only.
• With roleAssignments/write and the Allow user to assign all roles condition, Trustle can assign any Azure role in the subscription, Owner too. For read-only access, leave out roleAssignments/write and roleAssignments/delete.
• Assign the custom role only in the subscriptions that Trustle must manage.
• Foundry User also lets the app run, change, and delete agents, read agent threads and messages, and read the resource keys and connection secrets. Trustle reads only the Foundry resources, projects, and agents.
• Store the client secret in a secret manager. Never commit it to a repository.
• Before the secret expires, create a new one. Then paste the new value into the Trustle connection.

Troubleshooting

Test Connection fails

The test uses only the Entra ID values. See Test Connection fails on the Microsoft Entra ID page.

Test Connection passes, but no subscriptions or Azure roles show

The app has no role in the subscription. Do Step 2. Then run the sync again. A new role assignment can take a few minutes to take effect in Azure.

Some subscriptions are missing

Each subscription needs its own role assignment. Do Step 2 in each missing subscription.

PIM eligible or active roles are missing

• Your tenant needs Microsoft Entra ID P2. Without it, Azure refuses the PIM requests and Trustle skips them.
• The custom role needs roleEligibilityScheduleInstances/read and roleAssignmentScheduleInstances/read.

Management groups are missing

Assign Management Group Reader at the tenant root group. See Step 3.

Foundry agents are missing

Assign Foundry User on each Foundry resource, or on its resource group or subscription. See Step 4. A role on a Foundry project does not work. Trustle shows the agents after the next sync. A new role assignment can take a few minutes to take effect in Azure.

Foundry agents cannot sign in to Trustle

The app issues version 1 tokens. Set api.requestedAccessTokenVersion to 2 in the app manifest, as Step 4 describes. If Trustle warns that it could not read the app registration, grant Application.Read.All with admin consent.

Trustle cannot assign or remove an Azure role

• The custom role needs roleAssignments/write and roleAssignments/delete.
• The role assignment needs the Allow user to assign all roles (highly privileged) condition.

None of these fixes work

Email support@trustle.com. Include the error message, the connection name, and the Directory (tenant) ID and the Application (client) ID. Never send a secret, key, or token.