Back to Guides
Beginner

Azure Service Principal Setup

Create and configure an Azure service principal for deploying to Microsoft Azure

15 minutesLast updated: November 2025

What you'll learn

  • How to create an Azure service principal
  • Required roles for deployment automation
  • How to get Client ID, Client Secret, Tenant ID, and Subscription ID
  • How to connect Azure to Focal Deploy

Prerequisites

  • A Microsoft Azure account (free tier available)
  • An active Azure subscription with billing enabled
  • Owner or Contributor permissions on the subscription
1

Open Azure Portal

Navigate to the Azure Portal and sign in with your Microsoft account.

Open App Registrations
2

Register a New Application

  1. In the Azure Portal, search for "App registrations"
  2. Click "+ New registration"
  3. Enter name: focal-deploy
  4. Select "Accounts in this organizational directory only"
  5. Leave Redirect URI empty (not needed)
  6. Click "Register"

Note: After registration, you'll see the Application (client) ID and Directory (tenant) ID. Copy these - you'll need them later!

3

Create a Client Secret

  1. In your app registration, go to "Certificates & secrets"
  2. Click "+ New client secret"
  3. Enter description: Focal Deploy Secret
  4. Select expiration: 24 months (recommended)
  5. Click "Add"

CRITICAL: Copy Secret Value Immediately!

The secret value is only shown once. Copy it immediately and store it securely.

  • Never commit to Git
  • Never share publicly
  • Store in a password manager
4

Get Your Subscription ID

  1. In Azure Portal, search for "Subscriptions"
  2. Click on your subscription
  3. Copy the Subscription ID from the overview page
Open Subscriptions
5

Assign Contributor Role

Grant the service principal access to your subscription:

  1. Go to your Subscription in Azure Portal
  2. Click "Access control (IAM)" in the left menu
  3. Click "+ Add" → "Add role assignment"
  4. Select role: "Contributor"
  5. Click "Next"
  6. Click "+ Select members"
  7. Search for focal-deploy
  8. Select it and click "Select"
  9. Click "Review + assign"
Contributor Role

Allows creating and managing VMs, VNets, NSGs, and storage

Optional: For more restrictive access, you can create a custom role with only the permissions needed for VM deployments.

6

Collect Your Credentials

You should now have the following four pieces of information:

Subscription ID

From Step 4

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Tenant ID (Directory ID)

From Step 2 - App Overview

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Client ID (Application ID)

From Step 2 - App Overview

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Client Secret

From Step 3

••••••••••••••••••••
7

Add to Focal Deploy

  1. Log in to your Focal Deploy dashboard
  2. Navigate to Settings → Cloud Providers
  3. Click "Add Azure Credentials"
  4. Enter your Subscription ID
  5. Enter your Tenant ID
  6. Enter your Client ID
  7. Enter your Client Secret
  8. Click "Test Connection" to verify
  9. Click "Save Credentials"

Success! Your Azure credentials are securely stored and encrypted. Ready to deploy to Microsoft Azure!

Alternative: Azure CLI Method

If you have Azure CLI installed, you can create a service principal with a single command:

az ad sp create-for-rbac --name "focal-deploy" --role contributor \
  --scopes /subscriptions/{subscription-id} \
  --sdk-auth

Replace {subscription-id} with your actual subscription ID. This command outputs all credentials in JSON format.

Security Best Practices

DO

  • Use separate service principals per environment
  • Rotate client secrets every 12-24 months
  • Use the principle of least privilege
  • Enable Azure AD audit logging
  • Monitor service principal sign-ins

DON'T

  • Use your personal Azure credentials
  • Share service principal credentials
  • Commit credentials to Git repositories
  • Give Owner role (Contributor is sufficient)
  • Use the same credentials across apps

Next Steps

Deploy Your First App

Now that your Azure credentials are set up, deploy your first application to Microsoft Azure.

Add AWS Too

Deploy to multiple clouds? Set up your AWS IAM credentials for maximum flexibility.

Need help? Contact support or join our Discord

2025 Focal Deploy. All rights reserved. Licensed under the Focal Deploy Proprietary License.