Connect Azure to ProofKit
ProofKit reads your Azure subscription through a read-only app registration you create in your own tenant. It only ever calls login.microsoftonline.com, management.azure.com and, if you opt in to identity checks, graph.microsoft.com. It never writes, deletes, or changes anything. About 5 minutes in the portal, or two CLI commands.
1. Create the app and grant Reader (one command)
Scope it to exactly one subscription. This creates the app registration, its secret, and the role assignment in one go.
az ad sp create-for-rbac --name ProofKit --role Reader --scopes /subscriptions/<subscription-id>The command prints four values. Here is where each one goes:
| CLI output | ProofKit field |
|---|---|
appId | Client (application) ID |
password | Client secret |
tenant | Tenant ID |
| (the value you passed in --scopes) | Subscription ID |
2. Optional: Entra identity checks (Pro and MSP)
Only needed if you want MFA registration, Conditional Access, privileged role and guest/stale user checks. Add these Microsoft Graph application permissions to the same app registration, then grant admin consent:
| Permission | Used for |
|---|---|
Policy.Read.All | Conditional Access policies, security defaults |
Directory.Read.All | Users, directory roles, guest accounts |
Reports.Read.All | MFA registration details, sign-in activity |
AuditLog.Read.All | Sign-in activity for stale user detection |
RoleManagement.Read.Directory | Global Administrator role membership |
az ad app permission add --id <client-id> --api 00000003-0000-0000-c000-000000000000 \
--api-permissions "246dd0d5-5bd0-4def-940b-0421030a5b68=Role" \
"7ab1d382-f21e-4acd-a863-ba3e13f7da61=Role" \
"230c1aed-a721-4c5d-9cb4-a90514e508ef=Role" \
"b0afded3-3588-46d8-8b3d-9842eff778da=Role" \
"483bed4a-2ad3-4361-a73b-c83ccdbdc53c=Role"
az ad app permission admin-consent --id <client-id>Then check "Also run Entra identity checks" when you connect the subscription in ProofKit.
Or in the portal
- Create the app: Microsoft Entra ID > App registrations > New registration. Name it ProofKit, leave everything else default, Register.
- Copy two IDs from the app's Overview page: Application (client) ID and Directory (tenant) ID.
- Create a secret: Certificates & secrets > New client secret. Copy the secret VALUE now; it is only shown once.
- Grant Reader: Subscriptions > your subscription > Access control (IAM) > Add > Add role assignment > Reader > Members > select the ProofKit app > Review + assign.
- Copy the Subscription ID from the subscription's Overview page.
Then paste the four values into ProofKit
Open your subscription in ProofKit and fill in the Connect Azure form: tenant ID, client ID, client secret, subscription ID. ProofKit tests the connection before saving anything.
What ProofKit can and cannot do with this
- Can: read resource configuration, Resource Graph queries, and (if granted) Entra identity signals for the checks above.
- Cannot: change a setting, delete a resource, read data inside a resource (blobs, database rows, secret values), or see anything outside the scopes you granted.
- The client secret is stored encrypted and never shown again in the UI.
- Revoke access any time by deleting the app registration or removing its role assignment in Azure; ProofKit keeps the run history you already have.