Azure

Firefly integrates with Microsoft Azure to pull in information about your cloud resources—such as virtual machines, storage accounts, and databases—directly into your Firefly Inventory. This enables you to view, manage, and govern Azure assets alongside resources from other cloud providers. You can use Firefly to enforce infrastructure-as-code (IaC) practices and apply policies across your Azure environment, helping ensure compliance, visibility, and best practices at scale.

Best Practices

1. Ensure the service principal has read access to all resource groups you want scanned.

2. Use dedicated service principals for Firefly's access rather than sharing with other applications.

3. For governance, mark certain subscriptions as production during integration (Firefly has a "Mark as Production" checkbox for each integration which you should tick for your production accounts).

4. Monitor the Firefly service principal in Azure to ensure it's not being used elsewhere.

Integration Methods

Using ARM Template

ARM Template is the recommended method for Azure integration as it provides automated deployment through the Azure Portal.

Prerequisites

• Ensure you have appropriate permissions in Azure to deploy ARM templates.

• Access to the Azure Portal.

• Proper access to the subscriptions or management groups you want to integrate.

Setup Procedure

1. In Firefly, go to Settings > Integrations > Add New > Azure.

2. Select your integration method:

   • Individual Subscriptions > ARM Template (Recommended)

   • Management Group (Auto-Discover) > ARM Template

3. Click Deploy to Azure to open the ARM template in the Azure Portal.

4. Generate a Firefly API Key by clicking Generate API Key in Firefly.

5. Copy the key and paste it into the ARM template as instructed.

6. Follow the instructions in the Azure Portal to complete the deployment.

Using PowerShell

Firefly also provides a PowerShell onboarding script: gofireflyio/ps-firefly-azure-onboarding. It creates the app registration and service principal Firefly needs, assigns the standard read-only, Billing Reader (cost optimization), and Security Center roles, and can read .tfstate-suffixed blobs. Each of these can be toggled off individually ($enableActiveDirectory, $enableCostOptimization, $enableSecurityCenterResources).

Azure Discovery Status

To scan your integration for changes and discover new assets:

Procedure

1. Go to Settings > Integrations > Azure.

2. Find the integration you want to scan.

3. For assets changes, on the integration menu, select Scan Assets.

4. For IaC stacks changes, on the integration menu, select Scan Stacks.

5. View changes in the Inventory and/or IaC Explorer after several minutes.