Skip to content

Azure

Manage Azure resources through Azure Resource Manager: resource groups, virtual machines, storage accounts, function apps and SQL databases. The connector manages the resources themselves. It does not read or write data inside them: there are no blob, queue, Service Bus or query operations.
Nodes Azure (actions), Azure Trigger (polling)
Auth OAuth 2.0 against Microsoft Entra ID, or a pasted access token
Availability Limited release. Not yet in the palette for customer workspaces.

Connecting

The connector is built for OAuth with the scope https://management.azure.com/.default. Its sign-in addresses contain a tenant placeholder that Flero does not fill in, so the OAuth sign-in may not complete.

As an alternative, an API Key credential holding an Azure Resource Manager access token is sent as the bearer token. Flero does not refresh such a token, so replace it before it expires.

There is no service-principal credential for Azure, and a Basic credential sends nothing.

What the workflow can do is set by the Azure role assignments of the identity behind the token.

Operations

Area Operations
Resource groups List, Create, Get, Delete
Virtual machines List, Create, Get, Delete
Storage accounts List, Create, Get
Function apps List, Create, Get
SQL databases List, Create, Get

Every operation needs a subscriptionId and an api-version (for example 2021-04-01 for resource groups). Most also need a resourceGroupName. The new group's ID is {{ $node["Create Resource Group"].output.data.id }}.

Triggers

The Azure Trigger polls the list operations, every 5 minutes by default.

Common errors

Symptom Check
Sign-in fails with a tenant error The known OAuth issue above. Use a pasted access token.
401 / ExpiredAuthenticationToken The pasted token expired. Paste a new one.
403 / AuthorizationFailed The identity lacks a role on the subscription or resource group.
400 / MissingApiVersionParameter Fill in api-version.

Found something out of date? This page lives in the Flero docs content set.