Skip to main content

​
About Azure Resource Manager

Azure Resource Manager (ARM) is the deployment and management control plane for Microsoft Azure - subscriptions, resource groups, role assignments, virtual machines, and every other resource provider are managed through it. The Serval integration lets workflows reach any part of the ARM API through Serval’s authenticated proxy, and it ships two ready-to-install workflows for assigning and unassigning Azure RBAC roles. Two built-in health checks confirm that authentication works and that the connection can see your subscriptions. Authentication: Sign in with Microsoft (recommended where available) or Client Credentials with your own Microsoft Entra app registration. Data sync: On-demand only. Nothing is synced into Serval on a schedule - workflows call Azure at run time, and Serval mints or refreshes tokens automatically for each request.

​
What the Azure Resource Manager integration enables

Anything defined in the Azure Resource Manager API can be accessed through Serval.

​
Get your credentials

There are two ways to connect. Sign in with Microsoft needs no setup on your side beyond an Azure account with subscription access. Client Credentials requires a Microsoft Entra app registration that you create and authorize yourself.
No credentials to create. You sign in with your own Microsoft account and Serval uses its operator-managed Microsoft Entra app (the same app as the Microsoft Graph integration) to act on your behalf.
The account you sign in with must have access to at least one Azure subscription (Reader or higher). If it can see zero subscriptions, the connection fails.

​
Connect in Serval

1

Click Connect

Open the Azure Resource Manager integration in Serval and click Connect.
2

Choose Sign in with Microsoft

This option appears (labeled Recommended) only when your Serval instance has Microsoft OAuth configured. If you do not see it, use Client Credentials instead.
3

Complete the Microsoft consent screen

Sign in and approve the requested access. Microsoft always shows the consent screen, including when you reauthorize.
4

Serval detects your tenant

Serval lists the subscriptions your account can see, takes the tenant from the first one, and names the connection “Azure ([first subscription name])”. If your account can see zero subscriptions, the connection fails with “no subscriptions found - user may not have access to any Azure subscriptions”.

​
Verifying the connection

The integration includes two health checks. Test Azure Resource Manager Connection verifies that the integration can authenticate by listing your Azure subscriptions.
  • Success: “Successfully connected to Azure Resource Manager. Found [number] subscription(s).”
  • Authentication failure: “Authentication failed. Please verify your Azure credentials are correct and have not expired.”
  • Authorization failure: “Authorization failed. The Azure application may lack permissions to list subscriptions.”
  • Any other error: “Unable to connect to Azure Resource Manager. Please verify your integration configuration.”
List Azure Subscriptions lists every subscription visible to the integration and reports how many are enabled.
  • Success: “Found [number] subscription(s), [number] enabled.”
  • No subscriptions visible: “No subscriptions found. The integration may lack permissions or there are no subscriptions in this tenant.”
  • Request errors: “Failed to list Azure subscriptions. Please check your permissions.”
If authentication succeeds but List Azure Subscriptions reports “No subscriptions found. The integration may lack permissions or there are no subscriptions in this tenant.”, your credentials are valid but the app’s service principal has no Azure RBAC roles. Add Reader or higher on each subscription via Access control (IAM) and re-run the check.

​
Gotchas and troubleshooting

Registering the Entra app and granting the Azure Service Management API permission is not enough: what the connection can actually do in Azure is governed by RBAC role assignments on each subscription. Without them, both health checks fail - “No subscriptions found. The integration may lack permissions or there are no subscriptions in this tenant.” is the telltale result. Assign Reader, Contributor, or Owner to the app’s service principal per subscription via Access control (IAM), and repeat for every subscription Serval should reach.
Entra client secrets have a fixed expiration. Once expired, requests fail with “The client secret for application ‘[client ID]’ has expired.” and the connection health check reports authentication failure. When creating a secret, copy the Value column (not the Secret ID) immediately - Azure never shows it again. When it expires, generate a new secret under Certificates & secrets, then click Reconnect in Serval and enter the new secret Value along with the other connection fields.
The OAuth connect path detects your tenant by listing subscriptions: the tenant comes from the first subscription returned, and the connection is auto-named “Azure ([first subscription name])”. If the signed-in user can see zero subscriptions, the install fails with “no subscriptions found - user may not have access to any Azure subscriptions”. Sign in with an account that has at least Reader on a subscription.
The connect dialog shows the Sign in with Microsoft button (labeled Recommended) only if your Serval instance has Microsoft OAuth credentials configured. Otherwise, Client Credentials is the recommended path. Reauthorizing always brings up the Microsoft consent screen again.
There is no partial-edit form for this integration. Clicking Reconnect on a connected integration reopens the connect dialog with every field empty, and the submit button stays disabled until Instance Name, Tenant ID, Client ID, and Client Secret are all filled in. Keep the full set of values handy when rotating a client secret - you will re-enter the other three values along with the new secret Value.
The integration’s outbound allow-list covers only management.azure.com. Other Microsoft endpoints - Microsoft Graph, Key Vault or Storage data planes, and so on - are not reachable through this integration. Use the Microsoft 365 (Microsoft Graph) integration for Graph calls.
Both bundled RBAC workflows require the scope to contain a subscription segment (used to resolve role definition IDs). Management-group-only scopes are rejected with “Invalid scope: [scope]. Must include /subscriptions/[subscription ID]”. Note that Assign Azure RBAC Role is idempotent: if the principal already holds the role, it reports success with no action taken.
For deeper reference, see the Azure Resource Manager documentation and the Azure RBAC documentation.
Need help? Contact support@serval.com for assistance with your Azure Resource Manager integration.