Azure Setup

This guide walks you through setting up OIDC authentication between GitHub Actions and Azure. LeftSize uses federated credentials so no secrets are stored in your repository – GitHub Actions requests a short-lived token for each scan.

Prerequisites

• An Azure subscription with resources to scan
• Permission to create App Registrations in Azure AD
• A GitHub repository with LeftSize installed

Step 1: Create an App Registration

1. Go to the Azure Portal > Azure Active Directory > App registrations
2. Click New registration
3. Set the name to leftsize-scanner (or any name you prefer)
4. Leave Supported account types as the default (single tenant)
5. Click Register
6. Note the Application (client) ID and Directory (tenant) ID

Step 2: Add federated credentials

1. In the App Registration, go to Certificates & secrets > Federated credentials
2. Click Add credential
3. Select GitHub Actions deploying Azure resources
4. Configure:
   • Organization: Your GitHub organization or username
   • Repository: The repository where the LeftSize workflow runs
   • Entity type: Branch
   • Branch: main
   • Name: leftsize-scan
5. Click Add

If you use multiple branches or environments, add additional federated credentials for each.

Step 3: Assign roles

The App Registration needs read-only access to your subscription. Assign these roles at the subscription level:

1. Go to Subscriptions > select your subscription > Access control (IAM)
2. Click Add role assignment
3. Assign the following roles to the App Registration:

These are read-only roles. LeftSize never modifies your infrastructure.

Step 4: Add secrets to GitHub

In your GitHub repository, go to Settings > Secrets and variables > Actions and add:

Scanning multiple subscriptions

LeftSize supports scanning multiple Azure subscriptions using a matrix strategy. Edit your workflow to add environments:

strategy:
  fail-fast: false
  matrix:
    environment: [MAIN, PROD, DEV]

For each environment, create matching secrets:

• AZURE_CLIENT_ID_PROD, AZURE_SUBSCRIPTION_ID_PROD
• AZURE_CLIENT_ID_DEV, AZURE_SUBSCRIPTION_ID_DEV

Each environment needs its own App Registration with federated credentials and Reader + Monitoring Reader roles on the target subscription.

Verifying the setup

1. Go to your repository’s Actions tab
2. Select LeftSize Cost Optimization Scan
3. Click Run workflow
4. Check the workflow logs for successful Azure authentication

If authentication fails, verify:

• The federated credential matches your repository name and branch exactly
• The App Registration has Reader and Monitoring Reader roles on the subscription
• The secret names match the environment name in the matrix (e.g., AZURE_CLIENT_ID_MAIN for environment: MAIN)

Minimal permissions

LeftSize operates with read-only access. The scan:

• Reads resource metadata via Azure Resource Manager
• Reads metrics via Azure Monitor
• Never creates, modifies, or deletes any resources
• Never accesses data stored in your resources (no blob contents, no database queries)