Connect to Azure
Nullstone provisions and manages infrastructure in your Azure subscription, so it needs access to that subscription. Nullstone authenticates to Azure with Workload Identity Federation — a secretless method built on OpenID Connect (OIDC). No client secrets or certificates are created or stored: Azure trusts short-lived tokens issued by Nullstone, and you can revoke access at any time by deleting the App Registration or its federated credential.
Workload Identity Federation
You will create an App Registration in Azure, add a federated credential that trusts Nullstone's OIDC issuer, grant the App Registration access to your subscription, and finally enter the Tenant ID and Client ID in Nullstone.
TIP
When you add an Azure provider in the Nullstone UI, the Add Provider dialog displays the exact values used below — the generated App Registration Name, Issuer, Subject identifier, and Audience. Copy those values directly from the dialog as you follow these steps.
Step 1: Create an App Registration
In the Azure Portal, go to Microsoft Entra ID (Azure Active Directory) → App registrations → New registration. Use the App Registration Name generated by the Nullstone dialog (it looks like nullstone-<random>), leave the defaults, and click Register.
On the App Registration's Overview page, note the Application (client) ID and Directory (tenant) ID — you will enter these in Nullstone in Step 4.
Step 2: Add a Federated Identity Credential
In your App Registration, go to Certificates & secrets → Federated credentials → Add credential and choose the Other issuer scenario. Enter the values shown in the Nullstone dialog:
| Field | Value |
|---|---|
| Federated credential scenario | Other issuer |
| Issuer | The Nullstone OIDC issuer URL shown in the dialog |
| Subject identifier | engine.nullstone.io/<your-org> |
| Audience | api://AzureADTokenExchange |
Give the credential a name and click Add.
Step 3: Grant subscription access
Nullstone needs permission to manage resources in your subscription. In the Azure Portal, open your Subscription → Access control (IAM) → Add → Add role assignment, and assign both of the following roles to your App Registration's service principal (search for it by the App Registration Name from Step 1):
- Contributor — to create and manage resources.
- User Access Administrator — required for Terraform to provision managed identities and role assignments.
Step 4: Enter your credentials in Nullstone
In the Nullstone UI, go to Providers and click Add Provider. Select Azure for the provider type, then enter the Directory (tenant) ID and Application (client) ID you copied in Step 1.
FINISH
Click Test Connection before proceeding.
WARNING
To revoke Nullstone's access, delete the federated credential (Step 2) or the entire App Registration (Step 1) in the Azure Portal.