Create Azure Service Principal

This is the manual version of what the Helper: Azure Cloud Shell setup does for you (see Azure automations for the script, the Terraform and the permissions of every service).

You will end with five values for the credential: Tenant ID, Subscription ID, Resource Group, Client ID and Client Secret.

Step 1: Register the application

1. Open the Azure Portal (https://portal.azure.com) and go to Microsoft Entra ID (formerly Azure Active Directory) → App registrations.
2. Click New registration, enter a name (for example cloudplans-scheduler), choose Accounts in this organizational directory only and click Register.
3. Note the Application (client) ID and the Directory (tenant) ID.

Step 2: Create a client secret

1. In the application, open Certificates & secrets → Client secrets → New client secret.
2. Provide a description and an expiration (the helper uses 2 years) and click Add.
3. Copy the Value now: it is the Client Secret and it cannot be shown again.

Step 3: Create a custom role

Use a custom role with only the actions of the services you manage, instead of the broad Contributor role.

1. Open the resource group you want CloudPlans to manage (or the subscription, see the note below) → Access control (IAM) → Add → Add custom role.
2. Choose Start from JSON and paste a role like this one. It lets CloudPlans list, start and stop virtual machines:

{
  "Name": "CloudPlansSchedulerRole",
  "IsCustom": true,
  "Description": "CloudPlans least-privilege role",
  "Actions": [
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/instanceView/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/deallocate/action"
  ],
  "NotActions": [],
  "AssignableScopes": ["/subscriptions/<subscription-id>/resourceGroups/<resource-group>"]
}

3. For other services (AKS, VM scale sets, App Service plans, container instances, application gateways, Synapse, Service Bus, Cosmos DB, MySQL/PostgreSQL flexible servers, ML endpoints, VM resize...) add the actions listed for each one in Azure automations.
4. Review and create the role.

Step 4: Assign the role to the application

1. In the same Access control (IAM) page click Add → Add role assignment.
2. Select your custom role, then Members → Select members, search for the application you registered and select it.
3. Click Review + assign.

Step 5: Fill in the credential

Paste Tenant ID, Subscription ID, Resource Group, Client ID and Client Secret in the credential form (Create).