Microsoft Azure

Workload Identity Federation — no client secrets, ever.

PulseBoard's Azure integration mints an RS256 client assertion every tick, exchanges it for an Azure AD access token via ClientAssertionCredential, and pulls Azure Monitor metrics across your subscriptions. The customer's Federated Identity Credential pins our subject and audience — there are no client secrets to rotate.

Connect Azure → Azure docs

Azure Monitor coverage

Default metric plan keyed by resource type. Drop your own resource IDs and metric names into the config to extend it.

Resource type	Default metrics
`Microsoft.Compute/virtualMachines`	Percentage CPU · Available Memory Bytes · Disk Read/Write Bytes · Network In/Out Total
`Microsoft.Web/sites` (App Service)	Http2xx/4xx/5xx · Response Time · Requests · Cpu Time · Memory Working Set
`Microsoft.Storage/storageAccounts`	UsedCapacity · Transactions · Ingress · Egress · SuccessE2ELatency
`Microsoft.Sql/servers/databases`	CPU Percent · DTU Used · Storage · Connection Successful/Failed · Deadlocks
`Microsoft.ContainerService/managedClusters` (AKS)	kube_node_status_condition · kube_pod_status_ready · apiserver_current_inflight_requests
`Microsoft.DocumentDB/databaseAccounts` (Cosmos)	TotalRequests · TotalRequestUnits · ProvisionedThroughput · DataUsage
`Microsoft.ServiceBus/namespaces`	IncomingMessages · OutgoingMessages · ActiveMessages · DeadletteredMessages
`Microsoft.EventHub/namespaces`	IncomingMessages · OutgoingMessages · ThrottledRequests · IncomingBytes/OutgoingBytes
`Microsoft.KeyVault/vaults`	ServiceApiHit · ServiceApiLatency · ServiceApiResult · Availability
`Microsoft.Cache/redis`	CacheHits · CacheMisses · UsedMemory · ConnectedClients · ServerLoad

How the OIDC dance works

1
Cloud hosts an OIDC issuer
The PulseBoard cloud surface serves /.well-known/openid-configuration and /.well-known/jwks.json with our public RSA key.
2
Customer creates a Federated Identity Credential
One az ad app federated-credential create call, pinning subject = pulseboard:workspace/<slug>:account/<id> and audience = api://pulseboard. Idempotent on --app-name.
3
Cloud-poller mints an RS256 assertion
Every tick, our cloud-poller mints a fresh client assertion JWT and hands it to ClientAssertionCredential, which exchanges it at Azure AD for an access token cached ~1h.
4
Token used as Bearer to Azure Monitor
The poller calls MetricsQueryClient.QueryResourceAsync per resource, per metric, at your configured granularity (default 60s).

Onboarding script

Idempotent Azure CLI wrapper. Creates the App Registration, the Service Principal, the Federated Identity Credential, and assigns the Monitoring Reader role at subscription scope.

# From your Azure CLI session
git clone https://github.com/OpenPulseBoard/pulseboard-cloud-infra
cd pulseboard-cloud-infra/azure
./onboarding.sh \
  --app-name pulseboard-monitor \
  --subscription <sub-id> \
  --workspace-slug acme \
  --account-id <portal-account-id> \
  --issuer https://cloud.pulseboard.dev

Then paste the tenantId, clientId and subscriptionId the script prints into the wizard — that's all we ever store on our side.

What you get

Multi-subscription

One workspace can connect any number of Azure subscriptions. Each appears as its own cloud account in the portal.

Series shape

azure_monitor_<snake(metric)>{ResourceType,ResourceName,Aggregation,SubscriptionId,…} — the same Prom-series identity model as the rest of the platform.

Free-form metric list

Override the default plan per integration with arbitrary {resourceType: [metric]} pairs and a granularity in [30,3600] seconds.