Azure Integration with AWS Devops Agent

Background AWS Devops agent provides the capability to integrate Azure Devops & cloud environment to have a single place of integration. This article walks you through the steps for integrating the 2 clouds with streamlined instructions from AWS/Azure documentation.

Objective: Connect DevOps Agent to your Azure tenant to enable infrastructure investigation across AWS & Azure resources.

Using this article, we will:

• Register Azure Cloud with AWS Devops agent
• Create an Azure Service Principal so the DevOps Agent can read your Azure environment
• Connect Azure as a Capability Provider in the Agent Space
• Verify the agent can see and describe your Azure resources

Pre-requisites

• Enable Devops agent in the AWS console.
• Set up an Agentspace.
• Have access to the Azure account/credentials.
• Have a Valid Azure subscription.

Step 1:

• Register Azure Cloud with DevOps Agent.

There are two methods to do this. Both the methods are covered in this article.

• Admin Consent
• App Registration.

Method 1:

You will be redirected to Microsoft Entra ID page. If you select Admin consent. This requires signing in with an a Microsoft account.

• Once you select admin consent, you will be redirected again to verify your identity as a member of the authorized tenant.

• After registering, it will show up in the Capabilities providers.

• To confirm the addition, Go to portal.microsoft.com & choose Entra ID. Go to Enterprise Applications & Search for AWS Devops Agent as a connected application.

Method 2: Using App Registration

Step 1

In the AWS IAM console, go to *Account settings → Outbound Identity Federation *and enable it if not already enabled. Note the Token Issuer URL for step 5.

Step 2

Copy the Token Issuer URL value for the later steps.

Step 3

AWS Devops Agent authenticates to Azure using Workload Identity Federation, a trust relationship between **AWS's OIDC endpoint ** & the Azure App Registration eliminating the need for Client secret. In the Microsoft azure Portal, Search **Microsoft Entra ID ** (previously known as Microsoft Azure Active Directory)

Configure

• Name: 'AWS-Devops-Agent-Azure-Integration'
• Supported Account types: Accounts in the organizational directory only.
• Click Register

Step 4

Note down the Tenant ID & the client ID that will be needed for the later steps.

Step 5

In the new app registration, go to *Certificates & secrets → Federated credentials → Add credential

Select "Other issuer" as the scenario.

Add the token issuer URL saved in Step 1

Add the Subject identifier which was saved under Step 2.

Click Add

Step 6

1. In the Azure portal, search for Subscriptions and open your subscription.
2. In the left menu, click Access control (IAM) → Add → Add role assignment.
3. Under Role, search for and select Reader.
4. Click Next → Members → Select members.

5. Search for devops-agent-integration and select it.
6. Click Review + assign → Assign.
7. Check for Reader permissions on the Azure Access control (IAM).

Step 7

Under API permissions, grant the app the required permissions for Azure resources you want DevOps Agent to access.

In the AWS console, Go to AWS Devops agent> Capabilities Providers Register Azure Cloud> App Registration

Find Azure Cloud and click Add.

Enter the Tenant ID from the Azure account.

Enter the Client ID from the Azure account.

Review the details and click Submit. The wizard validates the federation trust by requesting a token from AWS’s OIDC endpoint and presenting it to Azure.

On success a message will be displayed, ”Azure identity registered successfully”. The wizard then immediately continues to the next step.

Step 8

Enter the Subscription ID in the DevOps Agent wizard

Once associated, Azure Cloud will appear under Capability providers. It should appear like below.

The Status column may initially show — — this is normal. The agent starts scanning your Azure subscription in the background and the status updates within a few minutes. You don’t need to wait for it before proceeding.

Verify the Agent Can See Azure Resources

Ask the Agent About Your Azure VM

1. Open the DevOps Agent web app via Operator access.
2. Click + New chat.
3. Type: What Azure resources do you have access to ?

The agent should query your Azure subscription and return a summary of discovered resources — including devops-agent-azure-vm, the resource group devops-agent-demo-rg, virtual network, and any other resources in the subscription. You can also ask What VM’s are running into Azure. Check the answer as below.

Check the Topology Graph

1. In the web app left sidebar, click Topology.
2. The graph now includes both AWS and Azure nodes.

Look for the Azure VM node alongside your EC2 instance and its connected AWS resources (security groups, subnet, VPC, CloudWatch alarm). The agent represents resources from both clouds in a single unified graph.

For adding projects to your Organizations in the AWS Devops agent refer to this link

Conclusion The total process to integrate both the environments should take less than 30 minutes. However, this article reduces the need to refer to multiple documentation sources for both the methods.