> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudeval.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect an Azure environment

> Create a Cloud sync connection in CloudEval AI and turn it into a project you can evaluate.

Use this path when you want CloudEval to evaluate an existing **Azure subscription** or a scoped set of **resource groups**.

This is the **Cloud sync** path. It reads deployed Azure resources and exports
template snapshots for analysis. It is different from the infrastructure-as-code
path, which starts from source files before deployment.

## What you need

<Warning>Do not use `Contributor` for normal production sync. Use the least-privilege `CloudEval Live Sync Reader` role unless you are testing in a disposable environment.</Warning>

* An **Azure service principal** with least-privilege access to the resource groups you want to evaluate
* The following values:
  * **client ID**
  * **client secret**
  * **tenant ID**
  * **subscription ID**

Use the [Azure Cloud sync permissions](/reference/azure-live-sync-permissions) guide to create a custom `CloudEval Live Sync Reader` role. Normal Cloud sync does not need `Contributor`.

## Create the connection

<Steps>
  <Step title="Open Connections">
    Open **Connections** in CloudEval and choose **Add connection**.
  </Step>

  <Step title="Choose Azure Cloud sync">
    Select **Azure** as the provider and **Cloud sync** as the source type.
  </Step>

  <Step title="Confirm least-privilege scope">
    Confirm that the service principal has the `CloudEval Live Sync Reader` role on the target subscription or resource groups.
  </Step>

  <Step title="Enter credentials">
    Enter the client ID, client secret, tenant ID, subscription ID, and target resource groups that match the role assignment scope.
  </Step>

  <Step title="Create and validate">
    Create the connection. CloudEval validates the credentials during creation.
  </Step>
</Steps>

## Create a project from the connection

After the connection is saved:

<Steps>
  <Step title="Create a project">
    Start a new project from the project creation flow.
  </Step>

  <Step title="Select the Azure connection">
    Choose the Azure connection you just created as the project source.
  </Step>

  <Step title="Start sync">
    Start the sync so CloudEval can pull deployed infrastructure data into the project.
  </Step>
</Steps>

CloudEval will pull the available infrastructure data into the project and make it available for reports and sharing.

## Create it from the CLI

Use the CLI when you want connection and project creation in one repeatable
command. The same least-privilege role and resource-group scope still apply:

<CodeGroup>
  ```bash create-project.sh theme={null}
  cloudeval projects create \
    --cloud-sync \
    --azure-tenant-id "$AZURE_TENANT_ID" \
    --azure-client-id "$AZURE_CLIENT_ID" \
    --azure-client-secret "$AZURE_CLIENT_SECRET" \
    --azure-subscription-id "$AZURE_SUBSCRIPTION_ID" \
    --resource-group rg-app \
    --name "Production Cloud sync" \
    --format json \
    --output ./cloudeval-project.json
  ```

  ```bash env.sh theme={null}
  export AZURE_TENANT_ID="00000000-0000-0000-0000-000000000000"
  export AZURE_CLIENT_ID="00000000-0000-0000-0000-000000000000"
  export AZURE_CLIENT_SECRET="..."
  export AZURE_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
  ```
</CodeGroup>

Repeat `--resource-group` for each scoped group the service principal can read.
The CLI also reads `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`,
`AZURE_CLIENT_SECRET`, and `AZURE_SUBSCRIPTION_ID` from the environment when
the matching flags are omitted.

## What success looks like

* **Connection test passes.**
* **Project shows synced infrastructure data.**
* **Cost and architecture reports** can run from the project or the Reports page.
* Network relationships are richer when the role also has `Microsoft.Network/networkWatchers/topology/action` on the Network Watcher scope.

## Common failure points

* **Wrong tenant or subscription ID**
* **Expired client secret**
* **Service principal access** that does not match the subscription or resource group scope
* Missing `Microsoft.Resources/deployments/exportTemplate/action`, which can make report inputs incomplete
* Missing Network Watcher topology access, which can make relationship enrichment sparse

## Next step

Continue to [Run your first reports](/quickstart/run-your-first-reports), or use [Connections and sync troubleshooting](/troubleshooting/connections-and-sync) if the connection test fails.