---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Create a Microsoft Azure service principal

# Create a Microsoft Azure service principal {#azure-create-serv-princ-cloud-mgt__title-azure-service-principal}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

To securely access resource and billing data on your Microsoft Azure account, the Discovery process must present appropriate Microsoft Azure account credentials. You create a special programmatic account --- a Microsoft Azure service principal --- to generate the required credentials.{#azure-create-serv-princ-cloud-mgt__shortdesc-azure-service-principal}

## Before you begin

Roles required:  
* discovery_admin, service_mapping_admin, sn_cmp.cloud_admin roles in Cloud Provisioning and Governance or sn_cloud_ops_ws.cloud_ops_admin role in Cloud Discovery Workspace.
* Operations on the Microsoft Azure portal require one of the following roles:
  * Azure or Azure AD (Active Directory) Administrator
  * Application Administrator
  * Application Developer
  * Cloud Application Administrator
  {#azure-create-serv-princ-cloud-mgt__ul_xvj_vds_mlb}and the Resource Policy Contributor role to create or modify resource policies.{#azure-create-serv-princ-cloud-mgt__ul-azure-roles-required-to-set-up}
{#azure-create-serv-princ-cloud-mgt__ul-azure-roles-required-to-set-up}
* Enable internal network connection between the MID Servers and the Azure Cloud API endpoints:
  * The US GovCloud URL is `https://management.usgovcloudapi.net/`.
  * The commercial Azure Cloud URL is management.azure.com.  
    Note:  
    It isn't necessary when adding a credential if the account being added is already a GovCloud account.
  {#azure-create-serv-princ-cloud-mgt__ul_g4z_vnc_3cc}
{#azure-create-serv-princ-cloud-mgt__ul_ur3_j25_5lb}

## Procedure

1. Log in to the Azure portal and navigate to Azure Active Directory.
2. Navigate to the App registrations section and click New application registration.  
   Enter the following information for your application:  
   {#azure-create-serv-princ-cloud-mgt__table_usx_ppl_wcb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Unique name for the application and its integration credentials. For example, <kbd class="ph userinput">ServiceNow Integration</kbd>. |
   | Supported account types | Specify who can use the application. |
   | Redirect URI (Optional) | URL that will access Azure. Typically the URL of the ServiceNow instance. |
   [ ]

   {#azure-create-serv-princ-cloud-mgt__table_usx_ppl_wcb}
3. Select Register to complete the app registration.
4. When registration completes, copy the Application (client) ID and Directory (tenant) ID values, and paste them in the text editor.
5. Label the values Application ID and Directory ID respectively.
6. In the Azure portal, navigate to the Certificates \& secrets section and New client secret then specify the following values:  
   {#azure-create-serv-princ-cloud-mgt__table_thp_prl_wcb__entry__2}

   | Field | Description |
   |-|-|
   | Key description | Description for the key. |
   | Duration | Expiration for the key. Note: Your organization may apply policies to restrict key durability. Select the appropriate duration. |
   [ ]

   {#azure-create-serv-princ-cloud-mgt__table_thp_prl_wcb}
7. Click Add.
8. Copy and paste the key value into the text editor and label the value Application key.
9. To enable the service principal to work with various Azure subscriptions, navigate to Subscriptions.  
   To manage multiple subscriptions, you must perform the following procedure for each subscription:
   1. Paste the subscription ID into the text editor and label it Subscription ID.  
      The text file that you generate during this procedure might look something like this:
   2. Navigate to the subscription and select Access Control (IAM) from the menu.
   3. Click + Add at the top of the screen then Add role assignment.
   4. Select the value reader from the Role field.  
      Let the default value User, group, or service principal remain as is in the Assign access to field.  
      Note:  
      The Resource policy contributor role is only required for provisioning.
   5. Select the name you created in step 2 in the Select field and click Save.  
   {#azure-create-serv-princ-cloud-mgt__substeps_zvy_psl_wcb}
10. Perform the appropriate action.
    * If you are not using Cloud Discovery through Cloud Discovery Workspace, do the following:

      In the Discovery Manager, click the plus icon (+) and then select Azure Service Principal from the list.
    * If you are using Cloud Discovery through Cloud Discovery Workspace, do the following:  
      1. Navigate to AllConnections \& CredentialsCredentials.
      2. Select New.
      3. Select Azure Service Principal.
      {#azure-create-serv-princ-cloud-mgt__ol_jqr_gdg_jsb}
    {#azure-create-serv-princ-cloud-mgt__choices_sjc_bcg_jsb}
11. Specify the following values on the Azure Service Principal form:  
    {#azure-create-serv-princ-cloud-mgt__table_m3f_bqm_wcb__entry__2}

    | Field | Value |
    |-|-|
    | Name | Name of the service principal to register with the instance. For example, <kbd class="ph userinput">Azure service principal credentials</kbd>. |
    | Authentication Method | Select Client secret. The Secret key field appears when you select Client secret. Note: Client assertion is not supported. |
    [ ]

    {#azure-create-serv-princ-cloud-mgt__table_m3f_bqm_wcb}
12. Copy and paste values from the temporary text file into the remaining fields.  
    {#azure-create-serv-princ-cloud-mgt__table_ibl_3nd_3z__entry__2}

    | Credentials form field | Azure Service Principal value |
    |-|-|
    | Tenant ID | Azure Directory ID value from the text file. |
    | Client ID | Azure Application ID value from the text file. |
    | Secret key | Azure Application key value from the text file. |
    [ ]

    {#azure-create-serv-princ-cloud-mgt__table_ibl_3nd_3z} {#azure-create-serv-princ-cloud-mgt__service-principals-fields}
{#azure-create-serv-princ-cloud-mgt__service-principals-fields}
13. Click Save to create the Azure service principal.
14. Click the Discover Subscriptions related link to find all subscriptions for the Azure service principal.  
    The instance creates a service account for each discovered subscription. The Azure Subscriptions related list displays all subscriptions for the Azure service principal.
15. Click a subscription to view the service account created for the subscription.
16. Click a Discovery status entry in the Credential Discovery Status list to view the Discovery log.  
    Each time you click Discover Subscription, the instance generates a new Discovery status and displays it in the Credential Discovery Status list.
{#azure-create-serv-princ-cloud-mgt__collect-azure-IDs}

## What to do next

Cloud Provisioning and Governance only: Create a record of the service principal credentials on the ServiceNow instance so that Cloud Provisioning and Governance processes can access Microsoft Azure data. See [Store the Azure service principal credentials in the instance](https://servicenow-prod.fluidtopics.net/DvzfkOrfQSrS9kcVzwkzGA "To securely access data on your provider account, the Discovery process must present appropriate credentials. To make the credentials available to Discovery, you first create Azure service principal credentials in the Azure Portal. You then securely store the credentials in a service account in your instance.").

*[\>]: and then