Prerequisites

Overview

To successfully integrate your Azure environment with Upwind using the SaaS deployment model, ensure the following prerequisites are met. Select the deployment method that matches your setup - Terraform or Azure Resource Manager (ARM) templates - to see its prerequisites.

No scanner quota needed

With SaaS, the CloudScanner compute runs in Upwind-managed subscriptions, so you do not need to reserve Spot VM quota or any other scanner capacity in your own subscriptions.

Terraform

1. Access to your Azure tenant. Ensure you can sign in to the Azure tenant you are connecting with an identity that is permitted to create the required identities and role assignments.

2. Azure CLI authentication. Ensure the Azure CLI is installed and that you are logged in (az login) to the correct tenant. The readiness check in the onboarding flow runs through the Azure CLI.

3. Terraform installation. Ensure Terraform is installed on your local machine. You can download the latest version of Terraform from the official website. Follow the installation instructions specific to your operating system.

4. Permissions to create the Upwind identities. When you let onboarding create a new Service Principal for Upwind (the default), the identity running Terraform must be able to create app registrations in your Microsoft Entra tenant - for example, through the Cloud Application Administrator or Application Administrator Entra role. If your organization restricts app registration creation, you can instead use an existing Service Principal.

5. Permissions to assign roles at the connected scope. The identity running Terraform must be able to create role assignments at the scope you connect - for example, the Owner role over the tenant root management group, management groups, or subscriptions in scope. To onboard at the tenant or management-group scope, you may first need to elevate access to manage the tenant root.

Azure Resource Manager

1. Access to your Azure tenant. Ensure you can sign in to the Azure tenant you are connecting with an identity that is permitted to create the required identities and role assignments.

2. Azure CLI authentication. Ensure the Azure CLI is installed and that you are logged in (az login) to the correct tenant. Both the readiness check and the ARM deployment script run through the Azure CLI.

3. Permissions to create the Upwind identities. When you let onboarding create a new Service Principal for Upwind (the default), the identity running the deployment must be able to create app registrations in your Microsoft Entra tenant - for example, through the Cloud Application Administrator or Application Administrator Entra role. If your organization restricts app registration creation, you can instead use an existing Service Principal.

4. Permissions to assign roles at the connected scope. The identity running the deployment must be able to create role assignments at the scope you connect - for example, the Owner role over the tenant root management group, management groups, or subscriptions in scope. To onboard at the tenant or management-group scope, you may first need to elevate access to manage the tenant root.

5. Azure Deployment Stack Contributor role. ARM template onboarding deploys resources using deployment stacks, which requires the built-in Azure Deployment Stack Contributor role at the onboarding scope, in addition to the role-assignment permissions above. The readiness check does not verify this role, so confirm it is assigned before deploying.

tip

The Readiness check in the onboarding flow runs a preflight script that validates these prerequisites for you and highlights any missing access before you proceed.