Azure integration

Federated, keyless access

DriftGuard authenticates to Azure using a federated workload identity credential on an app registration — no client secrets stored anywhere. Drift detection needs only the built-in Reader role to compare your plan against live resources.

1. Register the identity

Create the app registration, add the federated credential DriftGuard shows you, and assign Reader:

# Register an app + service principal, then add a federated credential
az ad app create --display-name DriftGuard
az ad app federated-credential create --id APP_ID --parameters @fed.json

# Grant read-only Reader on the subscription
az role assignment create \
  --assignee APP_ID \
  --role Reader \
  --scope /subscriptions/SUBSCRIPTION_ID

2. Register in DriftGuard

Save the subscription, tenant, and client IDs plus the Blob Storage state backend in the dashboard (Settings → Azure). The repo config records which subscription and state DriftGuard reads:

# .github/driftguard.yml
integrations:
  azure:
    subscription_id: 00000000-0000-0000-0000-000000000000
    tenant_id: 11111111-1111-1111-1111-111111111111
    client_id: 22222222-2222-2222-2222-222222222222   # the federated app
    state_backend: https://acmetfstate.blob.core.windows.net/tfstate/prod.tfstate

Azure access is optional and read-only; it powers live-state drift detection only. DriftGuard is in early access.