Connecting Azure to Landfall

Landfall reads your Azure resource state through a single app registration (service principal) you create and scope yourself. Three values — a tenant ID, a client ID, and a client secret — are all it needs; nothing else is stored.

What you'll need

• An Azure AD (Entra ID) tenant, and permission to register an application in it.
• An admin on your Landfall organization, to save the connection under Settings → Integrations.

1. Register an app in Entra ID

Give the app registration read-only access scoped to what an investigation actually needs (e.g. Reader at the subscription or resource-group level) — not a broad Owner/Contributor role.

1. Entra ID → App registrations → New registration

   Name it something recognizable (e.g. landfall-integration).

   portal.azure.com/#view/Microsoft_AAD_RegisteredApps

   

2. Copy the Directory (tenant) ID and Application (client) ID

   Both are shown on the app registration's Overview page immediately after creation.

3. Certificates & secrets → New client secret

   Copy the secret's value (not its ID) immediately — Azure shows it once.

4. Grant a read-only role

   Under the subscription or resource group Landfall should see, add a role assignment for the app registration — Reader is enough for the investigator agent's read-only queries.

2. Add it to Landfall

In Landfall, open Settings → Integrations → Azure and paste the three values, then run Test connection.

Reference

This connection is read-only — the agent queries resource state, it never writes. See Integrations architecture for how every Landfall integration shares this same connector shape, and today's actual agent-access and incident-triggering status per integration (Azure is configuration/read-only on both fronts today).