Overview

This page walks you through the steps to connect your Azure Resource Manager account with RightScale for management purposes. If you are part of the Azure CSP program and wish to connect your partner data to RightScale for cost reporting purposes, see Connect Azure CSP to RightScale for Cost Reporting. If you wish to connect your Azure Enterprise Aggreement to RightScale for cost reporting purposes, see Connect Azure Enterprise Agreement to RightScale for Cost Reporting.

Create a Microsoft Azure Resource Manager Account

  1. Log in to your Microsoft account. https://login.live.com/
  2. Sign-up for a Microsoft Azure Resource Manager account. https://account.windowsazure.com/SignUp
  3. Create a subscription for the required services. Click the Sign up for a free trial option and provide the required personal and billing information.
  4. Click add subscription.

    [azure-subscription.png

  5. At a minimum, please select the 'Pay-As-You-Go' option and purchase the subscription.

  6. Click the Portal link. After going through the Microsoft Azure Resource Manager Tour, click on Settings in the left navigational pane.

Connect Microsoft Azure Resource Manager to your RightScale Account

Connect to the Cloud

  1. After logging into the Dashboard, go to Settings > Account Settings > Clouds. Click Connect to a Cloud.

  2. Next, click the (+) icon next to Microsoft Azure Resource Manager.

    arm-connect-to-public-clouds.png

  3. You will be taken to Microsoft Azure to complete the oauth authorization process. Click on Accept when prompted to give RightScale access.

    arm-rightscale-needs-permission-to-access-your-azure-service.png

  4. Select the target subscription from a list of available Azure Subscriptions to register.

    arm_Connect_RightScale_with_your_Azure_Active_Directory.jpg

  5. Next, you should see a successfully registered with clouds notification on the top bar.

    arm-successfully-registered-with-clouds.png

arm_multiple_tenants_no_subscription_available.jpg

Check the Cloud Status

On the same Clouds tab or on the Cloud Credentials widget in the Overview tab, you may check the status of your cloud. Both of these items must be valid and active (green) in order to successfully launch cloud servers: On the Dashboard, go to Settings > Account Settings > Clouds. You should be able to view all the Azure Resource Manager Regions

arm-view-all-arm-regions.png

Once your cloud credentials have been verified, you will see that the Microsoft Azure Resource Manager cloud is enabled under the Clouds tab. You will now see all of your Microsoft Azure Resource Manager resources under the Clouds menu (Clouds > AzureRM). You may need to refresh the tab to view your newly added Azure Resource Manager cloud.

Adding Newly Supported Regions

As RightScale adds support for addtional ARM Regions, complete the steps below to view them in RightScale for your ARM subscriptions that have been previously registered.

  1. Complete the standard ARM registration steps

The RightScale-Azure Integration

RightScale uses the Azure Service Principal approach to getting permissions to operate on your subscription, which is the recommended best practice as published by Microsoft.

In short, the RightScale web application is added to Azure Active Directory (AD) associated with the registered subscription. Then the RightScale application service principal (which shows up as a user) is granted the Contributor role to the subscriptions within that AD. The service principal is then used by RightScale to authenticate and make requests on your behalf. RightScale does not store any user credentials for this access in the platform. You can read more about this approach on the Microsoft Azure docs.

The registration process above performs the following tasks:

  1. Adds the RightScale web application to the Azure AD (if it is not already added)
  2. Adds the RightScale application service principal (user) to the specified subscription with the Contributor role
  3. Informs RightScale which subscription to use for this RightScale account

Each of the above steps is explained in more detail below.

Add the RightScale web app to Azure AD

In order for the RightScale service principal to be granted permissions on a subscription, the RightScale web application must first be added to Azure AD. Today, there is no way to add this application directly via the Azure Portal -- note that there is a RightScale application listed in the marketplace, but that application is used for SSO, not for cloud management integration.

The only way to add this today is to go through the cloud registration process through RightScale as specified above.

The user performing this action must have at least Service Admin on the AD, Global Admin will also work.

After registration, the only permission that the RightScale Service Principal will have on the Azure AD tenant is Sign-in and read user profile.

arm-ad-application.png

Grant RightScale permission to a subscription

In order for RightScale to be able to manage cloud resources, it must have permissions granted on the Subscriptions in Azure. The RightScale cloud registration process will automatically add the RightScale service principal to the specified subscription with the Contributor role -- this is the required role for RightScale to have in order to perform cloud management on Azure.

While this permission can be manually granted in AD, the RightScale cloud registration steps must still be followed in order to associate the RightScale account with the correct subscription.

The user performing this action must have at least User Access Administrator on the Subscription, Owner will also work.

After registration, the RightScale Service Principal will have Contributor access on the Subscription.

arm-subscription-users.png

Associating a RS account with an Azure subscription

The only method to associate a RightScale account with a subscription is to perform the RightScale cloud registration steps above.