Discovery for Microsoft Azure
If your cloud resources are in an Azure cloud, create a user identity called a service principal. This grants permissions to the MID Server to access selected resources.
Azure management groups and subscriptions
An Azure management group contains other management groups and subscriptions. The management groups in an Azure Cloud environment form a hierarchy, but don’t contain volumes or virtual machines. Subscriptions contain cloud resources, such as virtual machines. The subscriptions that belong to management groups are called sub-accounts.
The advantages of using management groups are:
Easy population of sub-accounts
After you configure the management group and supply the necessary credentials, you can test the account. If the test succeeds, Discovery returns a list of subscriptions in that management group. From this list, you can choose one or more subscription sub-accounts to include in the Discovery schedule using the management group. For more information on the hierarchy of management groups and subscriptions, see Organize your resources with Azure management groups
Discovery of sub-account resources using dynamically acquired credentials
When you run Discovery on your subscriptions, you do not need separate credentials for each sub-account. Discovery finds the credentials for the management group and maps them to all of the subscription sub-accounts. The Cloud Discovery process handles credentials automatically by acquiring a temporary credential for each sub-account via an Azure API. You can elect to use the default configuration or customize the MID Server to assume other roles for additional controls and security. In addition, Discovery can automatically refresh the list of sub-accounts and datacenters covered in a discovery schedule. For more information, see the KB article Retrieve newer accounts/sub-accounts automatically via Cloud Discovery.
A service principal for Azure cloud services is similar to a Microsoft Windows service account. It enables Windows processes to communicate with each other within an Active Directory domain.
To create the Azure service principal in your ServiceNow instance, copy the service principal credential values from the Azure portal into a text editor, and then transfer those values into the instance.
[Omitted image "azure-text-file.png"] Alt text: Text file that temporarily holds Azure service principal credential values
This table shows you the Azure Service Principal value and the location in Azure where you can find the values you need for the credentials.
| Cloud Provisioning and Governance setting | Azure Service Principal value | Location of the Azure value |
|---|---|---|
| Tenant ID | Azure Directory ID value from the text file. | Azure Active Directory > Properties > Directory ID |
| Client ID | Azure Application ID value from the text file. | Azure Active Directory > App registrations > Registered App.Application ID |
| Secret Key | Azure Application key value from the text file. | Azure Active Directory > App registrations > Registered App > Settings > Keys (hidden) |
| Account ID | Azure Subscription ID associated with the Tenant ID. | Azure Active Directory > Subscriptions > Subscription ID |
Verify the REST API permissions
Download the Cloud Discovery patterns spreadsheet so you can grant user permissions required for running the Discovery patterns. In addition to permissions, the spreadsheet also includes useful information such as pattern names, types, CI Classes, and links to vendor documentation. New patterns are available quarterly, so check periodically to be sure you have the latest version of the spreadsheet.
Data collected by Service Mapping during top-down discovery
To include discovered components into service instances, enable CI relationships used in tag-based discovery by Service Mapping. These CI relationships are available from the 1.0.68 release on the ServiceNow Store. For operational steps, see Tag-based discovery configuration.
Service Mapping uses tag-based discovery to create service instance maps including the Cloud components. The Service Mapping application comes with the following preconfigured CI relationships used for tag-based discovery. These CI relationships are available from the 1.0.68 release on the ServiceNow Store.
| CI | Relationship | CI |
|---|---|---|
| Configuration Item [cmdb_ci] | Hosted on::Hosts | Logical Datacenter [cmdb_ci_logical_datacenter] |
| Logical Datacenter [cmdb_ci_logical_datacenter] | Hosted on::Hosts | Cloud Service Account [cmdb_ci_cloud_service_account] |
Azure Cloud Discovery API list
|
CI Attributes |
Azure Attributes |
|
object_id |
response.name |
|
name |
response.name |
|
region |
response.displayName |
|
status |
Installed |
|
CI Attributes |
Azure Attributes |
|
object_id |
response.id |
|
name |
response.name |
|
status |
Installed/ Retired |
|
state |
|
|
CI Attributes |
Azure Attributes |
|
object_id |
id |
|
name |
name |
|
state |
available |
|
status |
Installed/ Retired |
|
CI Attributes |
Azure Attributes |
|
object_id |
id |
|
state |
|
|
name |
name |
|
cidr |
properties.addressSpace.addressPrefixes |
|
CI Attributes |
Azure Attributes |
|
subnetName |
response.name |
|
subnetId |
response.id |
|
resourceGroup |
response.properties.resourceGuid |
|
networkId |
response.id.split('/subnets/') |
|
networkName |
getNetwork(networkId) |
|
cidrBlock |
response.properties.addressSpace.addressPrefixes |
|
CI Attributes |
Azure Attributes |
|
state |
properties.provisioningState |
|
storage_type |
properties.BlobType |
|
volume_id |
id |
|
name |
name |
|
size_bytes |
properties.diskSizeGB * 1024 * 1024 * 1024 |
|
object_id |
id |
|
size |
response.properties.diskSizeGB |
|
"volume_container" |
containerName |
|
status |
Installed/ Retired |
|
CI Attributes |
Azure Attributes |
|
object_id |
id |
|
name |
name |
|
state |
properties.provisioningState |
|
CI Attributes |
Azure Attributes |
|
memory |
properties.hardwareProfile.vmSize |
|
state |
The instance statuses:- succeeded: on
|
|
object_id |
id |
|
cpus |
properties.hardwareProfile.vmSize |
|
disks |
properties.storageProfile.dataDisks |
|
nics |
properties.networkProfile.networkInterfaces[].size |
|
vm_inst_id |
properties.vmId |
|
name |
name |
|
status |
Installed/ Retired |
|
CI Attributes |
Azure Attributes |
|
name |
name |
|
object_id |
name |
|
vcpus |
numberOfCores |
|
memory_mb |
memoryInMB |
|
local_storage_gb |
resourceDiskSizeInMB |
|
cores |
numberOfCores |
|
CI Attributes |
Azure Attributes |
|
object_id |
response.id |
|
name |
response.name |
|
public_dns |
properties.dnsSettings.fqdn |
|
public_ip_address |
properties.ipAddress |
|
CI Attributes |
Azure Attributes |
|
object_id |
"properties.frontendIPConfigurations.properties.privateIPAddress OR properties.frontendIPConfigurations.properties.publicIPAddress, then call Public IP Address API" |
|
name |
"properties.frontendIPConfigurations.properties.privateIPAddress OR properties.frontendIPConfigurations.properties.publicIPAddress, then call Public IP Address API" |
|
ipaddress_type |
"properties.frontendIPConfigurations.properties.privateIPAddress ==> Private IP Address OR properties.frontendIPConfigurations.properties.publicIPAddress ==> Public IP Address" |
|
status |
Installed |
|
CI Attributes |
Azure Attributes |
|
object_id |
id |
|
name |
name |
|
private_ip |
properties.ipConfigurations |
|
public_dns |
call public ip address api - properties.dnsSettings.fqdn |
|
state |
properties.provisioningState |
|
is_static |
properties.ipConfigurations |
|
mac_address |
properties.macAddress |
|
public_ip |
call public ip address api - |
|
CI Attributes |
Azure Attributes |
|
name |
response.id |
|
object_id |
response.name |
|
guest_os |
properties.storageProfile.osDisk.osType |
|
image_source |
id |
|
status |
Installed/ Retired |
|
CI Attributes |
Azure Attributes |
|
name |
name |
|
object_id |
id |
|
sku_name |
sku.name |
|
state |
properties.provisioningState |
|
CI Attributes |
Azure Attributes |
|
object_id |
response.id |
|
name |
response.name |
|
state |
|
|
dns_name |
properties. |
|
fqdn |
|
|
canonical_hosted_zone_name |
|
---
title: Discovery for Microsoft Azure
description: If your cloud resources are in an Azure cloud, create a user identity called a service principal. This grants permissions to the MID Server to access selected resources.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/discovery/azure-cloud-discovery.html
release: australia
product: Discovery
classification: discovery
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 5
breadcrumb: [Discovery for cloud environment, Discovery, ITOM Visibility, IT Operations Management]
---
# Discovery for Microsoft Azure
If your cloud resources are in an Azure cloud, create a user identity called a service principal. This grants permissions to the MID Server to access selected resources.
## Azure management groups and subscriptions
An Azure management group contains other management groups and subscriptions. The management groups in an Azure Cloud environment form a hierarchy, but don’t contain volumes or virtual machines. Subscriptions contain cloud resources, such as virtual machines. The subscriptions that belong to management groups are called sub-accounts.
The advantages of using management groups are:
Easy population of sub-accounts
After you configure the management group and supply the necessary credentials, you can test the account. If the test succeeds, Discovery returns a list of subscriptions in that management group. From this list, you can choose one or more subscription sub-accounts to include in the Discovery schedule using the management group. For more information on the hierarchy of management groups and subscriptions, see [Organize your resources with Azure management groups](https://docs.microsoft.com/en-us/azure/governance/management-groups/overview)
Discovery of sub-account resources using dynamically acquired credentials
When you run Discovery on your subscriptions, you do not need separate credentials for each sub-account. Discovery finds the credentials for the management group and maps them to all of the subscription sub-accounts. The Cloud Discovery process handles credentials automatically by acquiring a temporary credential for each sub-account via an Azure API. You can elect to use the default configuration or customize the MID Server to assume other roles for additional controls and security. In addition, Discovery can automatically refresh the list of sub-accounts and datacenters covered in a discovery schedule. For more information, see the KB article [Retrieve newer accounts/sub-accounts automatically via Cloud Discovery.](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0961449)
A service principal for Azure cloud services is similar to a Microsoft Windows service account. It enables Windows processes to communicate with each other within an Active Directory domain.
To create the Azure service principal in your ServiceNow instance, copy the service principal credential values from the Azure portal into a text editor, and then transfer those values into the instance.
\[Omitted image "azure-text-file.png"\] Alt text: Text file that temporarily holds Azure service principal credential values
This table shows you the Azure Service Principal value and the location in Azure where you can find the values you need for the credentials.
|Cloud Provisioning and Governance setting|Azure Service Principal value|Location of the Azure value|
|-----------------------------------------|-----------------------------|---------------------------|
|Tenant ID|Azure **Directory ID** value from the text file.|**Azure Active Directory** > **Properties** > **Directory ID**|
|Client ID|Azure **Application ID** value from the text file.|**Azure Active Directory** > **App registrations** > **Registered App.Application ID**|
|Secret Key|Azure **Application key** value from the text file.|**Azure Active Directory** > **App registrations** > **Registered App** > **Settings** > **Keys \(hidden\)**|
|Account ID|Azure **Subscription ID** associated with the Tenant ID.|**Azure Active Directory** > **Subscriptions** > **Subscription ID**|
## Verify the REST API permissions
Download the [Cloud Discovery patterns spreadsheet](https://downloads.docs.servicenow.com/resource/enus/api/servicenow-discovery-patterns-api-details.xlsx) so you can grant user permissions required for running the Discovery patterns. In addition to permissions, the spreadsheet also includes useful information such as pattern names, types, CI Classes, and links to vendor documentation. New patterns are available quarterly, so check periodically to be sure you have the latest version of the spreadsheet.
## Data collected by Service Mapping during top-down discovery
To include discovered components into service instances, enable CI relationships used in tag-based discovery by Service Mapping. These CI relationships are available from the 1.0.68 release on the ServiceNow Store. For operational steps, see [Tag-based discovery configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/service-mapping/tag_discovery_configuration.md).
Service Mapping uses tag-based discovery to create service instance maps including the Cloud components. The Service Mapping application comes with the following preconfigured CI relationships used for tag-based discovery. These CI relationships are available from the 1.0.68 release on the ServiceNow Store.
|CI|Relationship|CI|
|---|------------|---|
|Configuration Item \[cmdb\_ci\]|Hosted on::Hosts|Logical Datacenter \[cmdb\_ci\_logical\_datacenter\]|
|Logical Datacenter \[cmdb\_ci\_logical\_datacenter\]|Hosted on::Hosts|Cloud Service Account \[cmdb\_ci\_cloud\_service\_account\]|
## Azure Cloud Discovery API list
<table id="table_mr2_1qm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
object\_id
</td><td>
response.name
</td></tr><tr><td>
name
</td><td>
response.name
</td></tr><tr><td>
region
</td><td>
response.displayName
</td></tr><tr><td>
status
</td><td>
Installed
</td></tr></tbody>
</table><table id="table_md1_hqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
object\_id
</td><td>
response.id
</td></tr><tr><td>
name
</td><td>
response.name
</td></tr><tr><td>
status
</td><td>
Installed/ Retired
</td></tr><tr><td>
state
</td><td>
</td></tr></tbody>
</table><table id="table_q1s_3qm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
object\_id
</td><td>
id
</td></tr><tr><td>
name
</td><td>
name
</td></tr><tr><td>
state
</td><td>
available
</td></tr><tr><td>
status
</td><td>
Installed/ Retired
</td></tr></tbody>
</table><table id="table_c5j_jqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
object\_id
</td><td>
id
</td></tr><tr><td>
state
</td><td>
</td></tr><tr><td>
name
</td><td>
name
</td></tr><tr><td>
cidr
</td><td>
properties.addressSpace.addressPrefixes
</td></tr></tbody>
</table><table id="table_nfw_jqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
subnetName
</td><td>
response.name
</td></tr><tr><td>
subnetId
</td><td>
response.id
</td></tr><tr><td>
resourceGroup
</td><td>
response.properties.resourceGuid
</td></tr><tr><td>
networkId
</td><td>
response.id.split\('/subnets/'\)
</td></tr><tr><td>
networkName
</td><td>
getNetwork\(networkId\)
</td></tr><tr><td>
cidrBlock
</td><td>
response.properties.addressSpace.addressPrefixes
</td></tr></tbody>
</table><table id="table_i3l_kqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
state
</td><td>
properties.provisioningState
</td></tr><tr><td>
storage\_type
</td><td>
properties.BlobType
</td></tr><tr><td>
volume\_id
</td><td>
id
</td></tr><tr><td>
name
</td><td>
name
</td></tr><tr><td>
size\_bytes
</td><td>
properties.diskSizeGB \* 1024 \* 1024 \* 1024
</td></tr><tr><td>
object\_id
</td><td>
id
</td></tr><tr><td>
size
</td><td>
response.properties.diskSizeGB
</td></tr><tr><td>
"volume\_container"
</td><td>
containerName
</td></tr><tr><td>
status
</td><td>
Installed/ Retired
</td></tr></tbody>
</table><table id="table_wdg_lqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
object\_id
</td><td>
id
</td></tr><tr><td>
name
</td><td>
name
</td></tr><tr><td>
state
</td><td>
properties.provisioningState
</td></tr></tbody>
</table><table id="table_flf_mqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
memory
</td><td>
properties.hardwareProfile.vmSize
</td></tr><tr><td>
state
</td><td>
The instance statuses:- succeeded: on
- running: succeeded/stopping
- deallocating: stopping/stopped
- deallocated: off
- terminated: error
</td></tr><tr><td>
object\_id
</td><td>
id
</td></tr><tr><td>
cpus
</td><td>
properties.hardwareProfile.vmSize
</td></tr><tr><td>
disks
</td><td>
properties.storageProfile.dataDisks
</td></tr><tr><td>
nics
</td><td>
properties.networkProfile.networkInterfaces\[\].size
</td></tr><tr><td>
vm\_inst\_id
</td><td>
properties.vmId
</td></tr><tr><td>
name
</td><td>
name
</td></tr><tr><td>
status
</td><td>
Installed/ Retired
</td></tr></tbody>
</table><table id="table_g25_mqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
name
</td><td>
name
</td></tr><tr><td>
object\_id
</td><td>
name
</td></tr><tr><td>
vcpus
</td><td>
numberOfCores
</td></tr><tr><td>
memory\_mb
</td><td>
memoryInMB
</td></tr><tr><td>
local\_storage\_gb
</td><td>
resourceDiskSizeInMB
</td></tr><tr><td>
cores
</td><td>
numberOfCores
</td></tr></tbody>
</table><table id="table_udj_nqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
object\_id
</td><td>
response.id
</td></tr><tr><td>
name
</td><td>
response.name
</td></tr><tr><td>
public\_dns
</td><td>
properties.dnsSettings.fqdn
</td></tr><tr><td>
public\_ip\_address
</td><td>
properties.ipAddress
</td></tr></tbody>
</table><table id="table_jkz_rqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
object\_id
</td><td>
"properties.frontendIPConfigurations.properties.privateIPAddress OR properties.frontendIPConfigurations.properties.publicIPAddress, then call Public IP Address API"
</td></tr><tr><td>
name
</td><td>
"properties.frontendIPConfigurations.properties.privateIPAddress OR properties.frontendIPConfigurations.properties.publicIPAddress, then call Public IP Address API"
</td></tr><tr><td>
ipaddress\_type
</td><td>
"properties.frontendIPConfigurations.properties.privateIPAddress ==> Private IP Address OR properties.frontendIPConfigurations.properties.publicIPAddress ==> Public IP Address"
</td></tr><tr><td>
status
</td><td>
Installed
</td></tr></tbody>
</table><table id="table_jrd_tqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
object\_id
</td><td>
id
</td></tr><tr><td>
name
</td><td>
name
</td></tr><tr><td>
private\_ip
</td><td>
properties.ipConfigurations
</td></tr><tr><td>
public\_dns
</td><td>
call public ip address api - properties.dnsSettings.fqdn
</td></tr><tr><td>
state
</td><td>
properties.provisioningState
</td></tr><tr><td>
is\_static
</td><td>
properties.ipConfigurations
</td></tr><tr><td>
mac\_address
</td><td>
properties.macAddress
</td></tr><tr><td>
public\_ip
</td><td>
call public ip address api -
</td></tr></tbody>
</table><table id="table_irp_wqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
name
</td><td>
response.id
</td></tr><tr><td>
object\_id
</td><td>
response.name
</td></tr><tr><td>
guest\_os
</td><td>
properties.storageProfile.osDisk.osType
</td></tr><tr><td>
image\_source
</td><td>
id
</td></tr><tr><td>
status
</td><td>
Installed/ Retired
</td></tr></tbody>
</table><table id="table_sf4_yqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
name
</td><td>
name
</td></tr><tr><td>
object\_id
</td><td>
id
</td></tr><tr><td>
sku\_name
</td><td>
sku.name
</td></tr><tr><td>
state
</td><td>
properties.provisioningState
</td></tr></tbody>
</table><table id="table_kcf_zqm_qmb"><tbody><tr><td>
CI Attributes
</td><td>
Azure Attributes
</td></tr><tr><td>
object\_id
</td><td>
response.id
</td></tr><tr><td>
name
</td><td>
response.name
</td></tr><tr><td>
state
</td><td>
</td></tr><tr><td>
dns\_name
</td><td>
properties.
</td></tr><tr><td>
fqdn
</td><td>
</td></tr><tr><td>
canonical\_hosted\_zone\_name
</td><td>
</td></tr></tbody>
</table>## Useful information
- [Microsoft Azure discovery solutions comparison](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/discovery/azure-discovery-methods.md)
- [Set up Azure service accounts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/setup-azure-service-accounts.md)
- [Install and configure MID Servers to access cloud environments](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/mid-server-configuration-cloud.md)
- [Microsoft Azure Cloud discovery using patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/discovery-and-service-mapping-patterns/azure-cloud-discovery-patterns.md)
| title | Discovery for Microsoft Azure |
| description | If your cloud resources are in an Azure cloud, create a user identity called a service principal. This grants permissions to the MID Server to access selected resources. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/it-operations-management/discovery/azure-cloud-discovery.html |
| release | australia |
| product | Discovery |
| classification | discovery |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 5 |
| breadcrumb | Discovery for cloud environmentDiscoveryITOM VisibilityIT Operations Management |