> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Credentials

> Store an Azure service principal in Ankra to provision and manage Azure Kubernetes Service (AKS). Currently in development - available for early access.

<Warning>
  **Azure support is in development.** The Azure tile in the credentials dialog is not yet enabled for self-service - [contact support](mailto:support@ankra.ai) if you want early access for your organisation.
</Warning>

Azure credentials store an Azure **service principal** used to provision and manage [Azure Kubernetes Service (AKS)](/guides/aks-clusters). Azure is managed-Kubernetes only - Ankra does not provision plain Azure VMs.

Unlike other providers, an Azure credential is not validated when it is stored: the service principal is checked when Ankra first authenticates with it (an OAuth client-credentials exchange against `login.microsoftonline.com`), and its permissions are exercised when a cluster is created.

## What Ankra Accesses

Ankra calls the Azure Resource Manager API with the service principal:

| Resource                      | Operations                   | Why it's used                                                       |
| ----------------------------- | ---------------------------- | ------------------------------------------------------------------- |
| Resource groups               | create, read                 | Ensure the resource group for the cluster exists                    |
| AKS managed clusters          | create, read, delete         | AKS cluster lifecycle                                               |
| Agent pools                   | create, read, update, delete | Scale and manage the cluster's node pools                           |
| Cluster admin credential      | read                         | Connect Ankra's agent to the cluster (`listClusterAdminCredential`) |
| Cluster power state           | start, stop                  | Stop and start the cluster from Ankra                               |
| Kubernetes versions, VM sizes | read                         | Available versions and node sizes in the wizard                     |

Node pricing shown in Ankra comes from the public [Azure Retail Prices API](https://prices.azure.com/api/retail/prices), which needs no credential.

## Preparing an Azure Credential

<Steps>
  <Step title="Create a service principal">
    Create a service principal with the **Contributor** role on the target subscription, for example with the Azure CLI:

    ```bash theme={null}
    az ad sp create-for-rbac \
      --name ankra-aks \
      --role Contributor \
      --scopes /subscriptions/<subscription-id>
    ```

    Note the `appId` (client ID), `password` (client secret), and `tenant` (tenant ID).

    **Contributor** on the subscription covers everything in the table above. To scope tighter, the service principal needs at least the ability to create resource groups plus **Azure Kubernetes Service Contributor** and **Azure Kubernetes Service Cluster Admin** on the resource groups Ankra will use.
  </Step>

  <Step title="Share it with Ankra (early access)">
    An Azure credential consists of four values: **subscription ID**, **tenant ID**, **client ID**, and **client secret**. During early access, [contact support](mailto:support@ankra.ai) to have the credential set up for your organisation - the self-service dialog and `ankra credentials` CLI do not cover Azure yet.
  </Step>
</Steps>