Azure
Manage Azure resources through the Azure CLI (az), governed at the wire
Vendor ID: azure · Categories: tools
Agents drive the Azure CLI (az) directly. The extension has no hand-written tools: az itself is the surface. The harness governs every request at the wire: reads by default, writes on a tier an administrator grants, and deletions only with a person's approval.
Temporarily unavailable. The az image is not shipped in current releases. Every published Azure CLI image carries dependencies with known high-severity vulnerabilities that have no compatible fix yet, and the release does not ship images that fail its vulnerability gate. Until Microsoft publishes a fixed version, an az call fails. Connections and settings are kept.
Availability. az needs a separate token for each Azure API it calls (Resource Manager and Microsoft Graph). The platform mints each one for the connected service principal and adds it only to requests for that API. The secret never enters the sandbox. The extension ships one toolkit, Azure, which owns az. Enable it and connect a service principal, and az appears as a tool you can add to an Agent block. It is not a standalone block on the canvas.
Setup
The extension signs in as an Entra service principal, never as a person.
- Go to Azure Portal → Microsoft Entra ID → App registrations → New registration.
- Under Certificates & secrets, create a client secret.
- On the subscription (or resource group) agents should manage, open Access control (IAM) and assign the app the narrowest role that works. Start with Reader.
- Copy the Directory (tenant) ID, the Application (client) ID and the secret value into the connection form.
The role you assign is the real limit on what agents can touch. The platform's tiers narrow it further, but never widen it.
Auth
| Credential | Notes |
|---|---|
oauth (Azure service principal) | Connected with the OAuth client-credentials grant. A connection counts as a service principal only when it was connected that way. |
What agents can do
- Read anything the service principal can read. This is the default for every call.
- Write (create, update, start, stop) only when an administrator grants the
writetier to the workspace's credential and the agent block allows writes. - Delete only after a person approves the exact request from an Agent step. An unattended run cannot delete.
See What administrators control.
Out of scope in v1.0.0
- Data-plane services: Storage, Key Vault and Container Registry. Their hosts (
*.core.windows.net,*.vault.azure.net,*.azurecr.io) are shared by every Azure customer, and storage access can travel inside the URL as a SAS token, which the harness cannot govern.azreaches onlymanagement.azure.comandgraph.microsoft.com, plus the sign-in host, which the harness answers itself, andazcliprod.blob.core.windows.net, whereazchecks for a newer version. No credential is ever sent to that last host. azextensions: installing one at runtime is disabled.
Troubleshooting
| Code | Meaning | What to do |
|---|---|---|
IDENTITY_NOT_CONFIGURED | The connection is not a client-credentials service principal, or its configuration names no tenant (or only common). | Reconnect with the client-credentials grant and your tenant ID. |
CLI_REQUEST_TIER_DENIED | az made a write or delete request and this call's tier is read. | Grant write on the workspace's credential and allow writes in the agent block. |
CLI_CONFIRMATION_REQUIRED | az made a delete request. | Run it from an Agent step, where a person approves that exact request. |
CLI_TIMEOUT_OUTCOME_UNKNOWN | az hit its deadline. Azure may already have accepted the request. | Check the resource with a read-only command before retrying. Start long operations with --no-wait. |
CLI_BOOTSTRAP_FAILED | az login failed, so the agent's command never ran. | Check the connection's tenant ID and client ID. |
See CLI extensions for how the harness works.