SETUP GUIDE
Azure Cloud Intelligence
Delegate a customer-owned Azure subscription or resource group through Azure Lighthouse with the built-in Reader role only.
Before you start
- Workspace owner access
- An Azure administrator for the delegated scope
- A customer tenant ID and one or more subscription IDs
Setup
- Open Cloud Intelligence, select Azure, then generate the Reader-only setup artifact.
- Choose subscription or resource-group scope and deploy the matching Bicep or CLI artifact in the customer tenant.
- Confirm Reader is the only delegated role.
- Enter the customer tenant and delegated scope in AntOps, create the connection and choose Verify delegation.
Verify and expected result
Verification checks the existing Lighthouse Reader delegation and reads supported Resource Graph inventory. It does not request customer credentials and does not make Azure writes.
The first successful inventory becomes a baseline. No supported resources found means the connection works and no inventory was discovered.
Common safe checks
Delegation verification failed
Check the customer tenant, selected scope and that the Lighthouse registration assignment is deployed with Reader only.
First scan has no event
This is expected. A first observation establishes the comparison baseline; later material changes create evidence.
Security and revocation
The generated artifact contains only the management-side identifiers required for a Reader delegation. It never contains an Azure certificate, private key, token or client secret.
Disable the AntOps monitor and remove the Lighthouse registration assignment and definition from the delegated customer scope. Do not remove unrelated Azure resources.