The Deployer documentation
Connecting your accounts

Connect Microsoft Azure

Microsoft Azure is Microsoft's cloud platform. To let The Deployer work inside your Azure account, you'll create a service principal — a login for software rather than a person, so your app can act on its own without using your personal Microsoft sign-in. Setting it up gives you four values to paste in, plus a region.

Current credential model. The Deployer connects to Azure with a service principal and a client secret, and deploys currently need a broad role. Use a dedicated Azure subscription for The Deployer's resources, so the service principal can't reach unrelated production systems, and give the client secret an expiry. Federated credentials are planned. See Permissions & security.

What you'll collect

  • Tenant ID — the id of your organization's Microsoft directory.
  • Client (App) ID — the id of the app registration you create.
  • Client Secret — a password for that app (shown only once).
  • Subscription ID — which Azure subscription (billing account) to build in.
  • Region — where your servers physically run (for example eastus).

Don't worry about the jargon — the steps below tell you exactly where each value appears. You can do this either in the Azure portal (clicking through, described here) or with one command if you have the Azure CLI (az) installed; see the tip at the end.

Step 1 — Register an app (this creates the service principal)

  1. Go to portal.azure.com and sign in.
  2. In the top search bar, open Microsoft Entra ID (this was previously called "Azure Active Directory").
  3. In the left menu choose App registrations → New registration.
  4. Give it a name like deployer, leave the defaults, and click Register.
  5. On the app's Overview page, copy two values:
    • Application (client) ID → this is your Client (App) ID.
    • Directory (tenant) ID → this is your Tenant ID.

Step 2 — Create a client secret

  1. Still on your app, open Certificates & secrets in the left menu.
  2. Click New client secret, add a description and an expiry, and click Add.
  3. Copy the secret's Value immediately — Azure shows it only once, and it's what you'll paste as Client Secret. (Copy the Value, not the "Secret ID".)

Step 3 — Give it permission on your subscription

The app can't do anything until it's allowed to act on a subscription:

  1. In the search bar open Subscriptions and click the subscription you want to use.
  2. Copy the Subscription ID shown on its overview — that's your fourth value.
  3. Open Access control (IAM) → Add → Add role assignment.
  4. Choose the Owner role, then on the members step select the app you registered (deployer), and save. Assign it on the dedicated subscription only.

"Owner" is a broad role. Deploys create and manage several kinds of resources, and we don't yet publish a least-privilege role for each architecture, so a narrower role is the most common cause of a deploy stopping halfway. Keeping the assignment on a subscription that holds nothing else is what limits its reach. See Permissions & security.

Step 4 — Pick a region

A region is the physical location of your data center. Choose one near most of your users so your app feels faster, and enter its short code — for example eastus, westeurope, or centralindia.

Step 5 — Paste everything into The Deployer

  1. In The Deployer, open Connections from the left sidebar.
  2. Under Cloud providers, click Add provider and choose Microsoft Azure.
  3. In Label, type a name for yourself, e.g. My Azure.
  4. Fill in the fields exactly:
    • Tenant ID — the Directory (tenant) ID from Step 1.
    • Client (App) ID — the Application (client) ID from Step 1.
    • Client Secret — the secret Value from Step 2.
    • Subscription ID — from Step 3.
    • Default Region (e.g. eastus) — your chosen region code.
  5. Click Connect & verify.

A verified badge means everything lines up. An error most often means the client secret was mistyped (or you copied the Secret ID instead of the Value), or the role assignment from Step 3 hasn't been added yet.

Faster: one command with the Azure CLI

If you have the Azure CLI installed and are signed in with az login, you can create the service principal in a single command:

az ad sp create-for-rbac --name deployer --role Owner --scopes /subscriptions/<your-subscription-id>

The output includes appId (your Client ID), password (your Client Secret), and tenant (your Tenant ID). Combine those with your Subscription ID and region.

Safety notes

  • The Client Secret is a password — don't share it or store it in plain text.
  • The Deployer encrypts these values before storing them. They're used by the deployment engine and aren't placed in AI prompts.
  • Client secrets expire. When one does, create a new secret in Azure and use Replace credentials in The Deployer — see Viewing & replacing your credentials.

The Resources links and video below walk through creating an Azure service principal. Once Azure shows verified, you can create a project.