Connect Azure with a service principal.
Where to create it
Microsoft Entra → App registrations → New registration. Then under Certificates & secrets, create a client secret. Finally, assign the app a Reader role on the subscription (read/write needs a Contributor-style role instead).
What you enter
- Directory (tenant) ID
- Subscription ID
- Application (client) ID
- Client secret
Permissions
Azure has no read/write toggle in the app — access comes from the role you assign the service principal on the subscription. The same principal also covers Blob object storage.