Azure Subscription Account Manual Onboarding

Manual Subscription onboarding can be done either through the Azure UI by following the steps below, or by using Azure CLI commands

Why this matters: UI and CLI trade off effort against repeatability — UI walks through each permission grant for teams that want that visibility, while CLI suits scripting the setup directly or repeating it across several subscriptions.

Onboard Through the Azure Portal

The steps below will guide you through the process of onboarding from the Azure portal. Please log in to the Azure portal and follow these steps

Onboard Using Azure CLI

The steps below need to be executed in the Azure Cloud Shell. Please log in to the Azure portal and launch the Cloud Shell from the navigation bar

To manage a Microsoft Entra ID app and to assign a role, the owner role is required.

az ad sp create-for-rbac -n <APP_NAME> --role Reader --scopes "/subscriptions/<SUBSCRIPTION_ID>"

<APP_NAME> : App name of your choice

<SUBSCRIPTION_ID> : Your azure subscription id, follow this link to get subscription id. https://learn.microsoft.com/en-us/azure/azure-portal/get-subscription-tenant-id#find-your-azure-subscription

The above command will create an <APP_NAME> of your choice and assign the Reader role for the <SUBSCRIPTION_ID> subscription that you want to onboard as a usage account in Mavvrik.

Go to Mavvrik and follow these steps to Connect Subscription and enter the credentials obtained in the previous cloud shell output.

If you don't have the Owner role to execute the above command, follow the steps below.

Create Microsoft Entra ID app and secret

To manage a Microsoft Entra ID app and create a client secret, the Microsoft Entra ID Application Administrator role is required.

az ad sp create-for-rbac --display-name "<APP_NAME>" --years=2 -o table

<APP_NAME>: Microsoft Entra ID app name of your choice
Capture App id and share it with Owner required to Assign Permissions to the App
Capture App Id, Password(Secret) and Tenant id and share it with the partner company required to Connect Root Tenant

To assign permissions to the Microsoft Entra ID app, it is recommended to have the Owner role. Alternatively, you can have both the Contributor and User Access Administrator roles.

Assign Permissions to the App

az role assignment create --assignee "<APP_ID>" --role "Reader" --scope "/subscriptions/<SUBSCRIPTION_ID>" -o table

<APP_ID> : Enter App id

<SUBSCRIPTION_ID> : Enter your subscription id

Connect Subscription

Login to Mavvrik as Owner
Go to Menu > Admin > Public Clouds
Click on Connect for the subscription under subscriptions tab of Azure & Enter required details
Click Connect.