Skip to main content
Use this path when you want CloudEval to evaluate an existing Azure subscription or a scoped set of resource groups. This is the Cloud sync path. It reads deployed Azure resources and exports template snapshots for analysis. It is different from the infrastructure-as-code path, which starts from source files before deployment.

​
What you need

Do not use Contributor for normal production sync. Use the least-privilege CloudEval Live Sync Reader role unless you are testing in a disposable environment.
  • An Azure service principal with least-privilege access to the resource groups you want to evaluate
  • The following values:
    • client ID
    • client secret
    • tenant ID
    • subscription ID
Use the Azure Cloud sync permissions guide to create a custom CloudEval Live Sync Reader role. Normal Cloud sync does not need Contributor.

​
Create the connection

1

Open Connections

Open Connections in CloudEval and choose Add connection.
2

Choose Azure Cloud sync

Select Azure as the provider and Cloud sync as the source type.
3

Confirm least-privilege scope

Confirm that the service principal has the CloudEval Live Sync Reader role on the target subscription or resource groups.
4

Enter credentials

Enter the client ID, client secret, tenant ID, subscription ID, and target resource groups that match the role assignment scope.
5

Create and validate

Create the connection. CloudEval validates the credentials during creation.

​
Create a project from the connection

After the connection is saved:
1

Create a project

Start a new project from the project creation flow.
2

Select the Azure connection

Choose the Azure connection you just created as the project source.
3

Start sync

Start the sync so CloudEval can pull deployed infrastructure data into the project.
CloudEval will pull the available infrastructure data into the project and make it available for reports and sharing.

​
Create it from the CLI

Use the CLI when you want connection and project creation in one repeatable command. The same least-privilege role and resource-group scope still apply:
Repeat --resource-group for each scoped group the service principal can read. The CLI also reads AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_SUBSCRIPTION_ID from the environment when the matching flags are omitted.

​
What success looks like

  • Connection test passes.
  • Project shows synced infrastructure data.
  • Cost and architecture reports can run from the project or the Reports page.
  • Network relationships are richer when the role also has Microsoft.Network/networkWatchers/topology/action on the Network Watcher scope.

​
Common failure points

  • Wrong tenant or subscription ID
  • Expired client secret
  • Service principal access that does not match the subscription or resource group scope
  • Missing Microsoft.Resources/deployments/exportTemplate/action, which can make report inputs incomplete
  • Missing Network Watcher topology access, which can make relationship enrichment sparse

​
Next step

Continue to Run your first reports, or use Connections and sync troubleshooting if the connection test fails.
Last modified on July 1, 2026