The Azure integration connects TigerTrust to your Azure subscription via a service principal. TigerTrust authenticates with Azure Active Directory and enumerates certificates across Key Vault, App Service, Application Gateway, and AKS without requiring the Azure CLI on your infrastructure.
Azure

​
What gets discovered

Key Vault certificates

All certificates in every Key Vault the service principal can access. Subject, issuer, thumbprint, expiry, and tags.

App Service certificates

TLS certificates bound to App Service Plans, including host names and Key Vault secret bindings.

Application Gateway

Both SSL listener certificates and trusted root certificates used for backend health probes.

AKS managed clusters

API server FQDN and managed cluster CA certificates. Reported with “AKS-Managed” as the issuer.

​
Service principal setup

1

Create the app registration

az ad app create --display-name "TigerTrust Discovery"
APP_ID=$(az ad app list --display-name "TigerTrust Discovery" --query "[0].appId" -o tsv)
az ad sp create --id $APP_ID
2

Generate a client secret

az ad app credential reset --id $APP_ID --years 2
Save the returned password as your clientSecret. Also note the tenant (tenantId) and appId (clientId).
3

Grant the Reader role at subscription scope

SUB_ID=$(az account show --query id -o tsv)
az role assignment create \
  --assignee $APP_ID \
  --role "Reader" \
  --scope "/subscriptions/$SUB_ID"
4

Grant Key Vault certificate access

az role assignment create \
  --assignee $APP_ID \
  --role "Key Vault Certificates Officer" \
  --scope "/subscriptions/$SUB_ID"

​
Minimum custom RBAC role

If your security policy prohibits the built-in Reader role, create a custom role with only the permissions TigerTrust requires: 
{
  "Name": "TigerTrust Discovery",
  "IsCustom": true,
  "Description": "Read-only discovery of certificates across Azure",
  "Actions": [
    "Microsoft.KeyVault/vaults/read",
    "Microsoft.KeyVault/vaults/certificates/read",
    "Microsoft.Web/certificates/read",
    "Microsoft.Network/applicationGateways/read",
    "Microsoft.ContainerService/managedClusters/read",
    "Microsoft.Resources/subscriptions/resourceGroups/read"
  ],
  "NotActions": [],
  "AssignableScopes": [
    "/subscriptions/{subscription-id}"
  ]
}
Save as role.json and create with: 
az role definition create --role-definition role.json
az role assignment create \
  --assignee $APP_ID \
  --role "TigerTrust Discovery" \
  --scope "/subscriptions/$SUB_ID"
For DNS-01 through Azure DNS, additionally assign DNS Zone Contributor on the target zone.

​
Connect from the product

1

Open the Azure integration

Go to Integrations > Cloud > Azure > Connect.
2

Enter credentials

Enter tenantId, clientId, clientSecret, and subscriptionId.
3

Verify authentication

Click Verify authentication. TigerTrust exchanges the credentials for an access token. Any Azure Active Directory error code is surfaced directly so you can diagnose the issue.
4

Configure scan scope

Toggle Key Vault, App Service, Application Gateway, and AKS discovery on or off. You can also restrict scanning to specific resource groups.

​
Troubleshooting

Client secrets expire. Regenerate the secret with az ad app credential reset and update the credential in Integrations > Cloud > Azure.
The Reader role at subscription scope grants access to vault metadata but not to certificate data. You need Microsoft.KeyVault/vaults/certificates/read via either the built-in Key Vault Certificates Officer role or a custom role.
Reader must be assigned at subscription scope. An assignment scoped to a resource group will miss Application Gateways in other resource groups.
Credentials are stored encrypted. In production, prefer managed identities over client secrets. If you use client secrets, set a calendar reminder to rotate them before they expire — an expired secret will silently stop all Azure discovery scans.

Azure DNS for ACME

Use the same service principal for DNS-01 challenge automation.

AWS integration

Add ACM discovery.

GCP integration

Add Google Certificate Manager and GKE.

Cloud integrations overview

Manage all cloud accounts from one place.