> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/enclaive-multi-cloud-platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/enclaive-multi-cloud-platform/tutorials/settings/bring-your-own-subscription/azure.md).

# Azure

Connect your Azure subscription to EMCP with OAuth, and run confidential workloads in your own Azure subscription.

1. Go to the `Settings` page and open the `BYOS` tab.
2. Click `Create Cloud oAuth` and select **Azure** as the cloud provider.
3. Enter an **Auth name** (and optional tags), then click **Connect**.
4. You are redirected to the Microsoft sign-in and consent screen — sign in with the Microsoft account that has access to your Azure subscription and approve the requested access.
5. Back in EMCP, finalize the connection by selecting the **default Azure subscription** that workloads should be created in.
6. The subscription appears as `ACTIVE` in your Cloud Keys list.

{% hint style="info" %}
The Microsoft account that grants consent must hold sufficient RBAC permissions on the target subscription — for example via the built-in **Contributor** role or a custom role with the permissions listed below. The subscription must also have the required resource providers registered and sufficient confidential-compute (DCasv5) vCPU quota.
{% endhint %}

To run a workload in your own Azure subscription, select this subscription when creating a Virtual Machine. The resources are provisioned in your subscription, on your billing.

<figure><img src="https://1689087729-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmzjpiPnGVwTaHdGYte2r%2Fuploads%2FToW9k9fyoINFZzgYhmGW%2Fimage.png?alt=media&amp;token=1dacbcf3-29ae-4394-8d96-0454e11daf2b" alt=""><figcaption></figcaption></figure>

#### What happens under the hood

1. **Consent** — EMCP uses the OAuth 2.0 authorization-code flow against Microsoft Entra ID. Microsoft returns a short-lived access token and a refresh token; your Microsoft password is never seen by EMCP.
2. **Storage** — the tokens are stored encrypted in the vHSM, in a namespace private to your team. Only the subscription owner can manage them.
3. **Usage** — before each Terraform run, EMCP refreshes the access token automatically and provisions the resources in your selected subscription. Unlike static keys, the credentials expire within an hour and renew themselves.
4. **Revocation** — deleting the subscription removes the tokens from the vHSM. You can additionally revoke EMCP's access at any time from your [Microsoft account's app permissions](https://myapplications.microsoft.com/), or an administrator can revoke it under **Microsoft Entra ID → Enterprise applications**.

## Prerequisites

Your Microsoft account must have a role granting the following actions on the target subscription — for example via the built-in **Contributor** role or a custom role with these permissions:

```
"Microsoft.Compute/virtualMachines/write",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Resources/subscriptions/resourceGroups/write",
"Microsoft.Resources/subscriptions/resourceGroups/delete",
"Microsoft.Network/networkInterfaces/write",
"Microsoft.Network/networkSecurityGroups/write",
"Microsoft.Network/networkSecurityGroups/securityRules/write",
"Microsoft.Network/publicIPAddresses/write",
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Network/virtualNetworks/write",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/powerOff/action",
"Microsoft.Network/virtualNetworks/subnets/write",
"Microsoft.Compute/virtualMachines/delete",
"Microsoft.Network/virtualNetworks/delete",
"Microsoft.Network/virtualNetworks/subnets/delete",
"Microsoft.Network/publicIPAddresses/delete",
"Microsoft.Network/networkSecurityGroups/delete",
"Microsoft.Network/networkSecurityGroups/securityRules/delete",
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/publicIPAddresses/join/action",
"Microsoft.Network/networkInterfaces/join/action",
"Microsoft.Compute/disks/delete",
"Microsoft.Network/networkInterfaces/delete"
```

### Required resource providers

Before connecting, register the following resource providers with your subscription:

* Microsoft.Capacity
* Microsoft.Compute
* Microsoft.Network
* Microsoft.Storage

To register them, go to **Subscriptions** → **Resource Providers** in the Azure portal, search for each name, and select **Register**.

Please verify that your account also has sufficient confidential-compute (DCasv5) vCPU quota in the datacenter regions where you plan to run workloads.