Skip to main content
Check the four required Azure values first:
  • client ID
  • client secret
  • tenant ID
  • subscription ID
The most common causes are an expired secret, the wrong tenant, or access that does not match the subscription you selected.
This usually means the service principal can authenticate but does not have the right level of access for discovery.Verify:
  • the service principal exists in the correct tenant
  • the subscription ID is valid
  • the principal has CloudEval Live Sync Reader on the target resource groups, or an intentionally broader subscription scope
See Azure Cloud sync permissions for the least-privilege role definition. Avoid Contributor unless you are testing in a disposable smoke environment.
Possible causes:
  • missing parameters file
  • template URL points to the wrong file
  • the wrong file is selected as the visualization source
  • a linked or nested ARM template was imported without .cloudeval/config.yaml
  • a GitHub App installation was limited to selected repositories and does not include the repository you are trying to import
  • unsupported or partial template structure
If the template depends on parameters, provide them explicitly instead of assuming default values will be enough.For multi-file ARM sources, keep the source tree intact and add:
The entry path must match the file path in the project workspace or repository.For GitHub-linked projects, update the GitHub App repository access if the expected repository is missing from the picker. Then use Sync from GitHub from the project source menu.See GitHub repository sync for GitHub App mapping, webhook behavior, and disconnected-installation recovery.
Possible causes:
  • you scoped to the wrong resource groups
  • the connection is pointed at the wrong subscription
  • the latest sync completed with partial coverage gaps
  • the role is missing Microsoft.Resources/deployments/exportTemplate/action, so CloudEval can read inventory but cannot build complete report inputs
  • the role is missing Microsoft.Network/networkWatchers/topology/action, so Network Watcher relationships are incomplete
Run the sync again only after confirming the source scope. Re-running the wrong scope just gives you a fresher version of the wrong project.

​
Next step

If the connection is healthy but the output problem shows up during report generation, continue to Reports and billing.
Last modified on July 1, 2026