Azure integration

Linking Azure lets dFlow call Azure Resource Manager on your behalf to list subscriptions, resource groups, and networking resources, and to create Worker Nodes (virtual machines) you attach to Environments.

dFlow uses Microsoft sign-in (OAuth), not pasted API keys. Access follows the Azure RBAC permissions of the account you sign in with. General habits for naming and scoping cloud accounts are in Cloud provider accounts.

Before you start

• A Microsoft work or school account (or personal account) that can sign in to the Azure subscription you want to use.
• Permission in Azure to read and create the resources dFlow needs (subscriptions, resource groups, virtual networks, network security groups, virtual machines, and SSH public keys). Your cloud admin may assign a role such as Contributor on the subscription or resource group.
• A dFlow Organisation role that can manage integrations. See Roles and permissions under Security and Team Management in the sidebar (cloudProviderAccounts permissions).
• Understanding that dFlow stores OAuth tokens encrypted and refreshes them automatically. You can disconnect an account from Integrations at any time.

1. Connect Azure in dFlow

1. Open Integrations.
2. On the Azure card, open Connect (or Settings if you already have accounts listed).
3. Click Connect account.
4. Enter an Account name your team will recognize (for example Production Azure or Staging West Europe).
5. Click Connect with Microsoft. You are redirected to Microsoft to sign in and grant access.
6. Pick the identity that owns or can manage the target subscription. dFlow always shows the account chooser so you do not accidentally use a stale personal session.
7. After approval, you return to dFlow and see a success message. The account appears in the Azure drawer with a Connected badge.

Expected outcome: The account is linked at the Organisation level. Flows that provision Azure Worker Nodes or list Azure resources can use this connection.

2. Optional: Save machine types

For faster environment setup, you can save machine types on each connected account. A machine type is a reusable template (region, VM size, image, disk, network, and SSH key settings) that the Add Environment wizard can use to provision a new worker in one step.

1. In the Azure integration drawer, find your account.
2. Click Add machine type (plus icon).
3. Complete the same Basic, Disk, and Network tabs as when adding a worker node directly. Machine types use a saved SSH key from the resource group rather than generating a new key at provision time.
4. Save. The machine type appears under the account and can be enabled or disabled.

You can also add machine types later from the Compute step when you create an Environment. See Add an Azure server under Worker Nodes and Compute in the sidebar for field-level detail.

3. Verify the connection

• The account card should show Connected. If it shows Disconnected, sign in again or ask your Azure admin whether conditional access or consent blocked the token.
• Open Workers (or start Add an Azure server) and confirm subscriptions and resource groups load for the linked account.

4. Operate safely

• Use a dedicated Azure identity or group for dFlow automation when your policy allows it.
• Name accounts clearly in dFlow (production-eu, sandbox) so teammates pick the right subscription during provisioning.
• Rotate access by disconnecting and reconnecting if you suspect token compromise. Removing the account in dFlow does not delete VMs already created in Azure.
• Azure network rules for new workers are set during worker creation. They are separate from Security groups under Security and Team Management in the sidebar, which today target AWS in the product UI.

Permission and connection errors

Related

• Cloud provider accounts
• Add an Azure server
• Integration permissions and prerequisites
• Integration troubleshooting
• AWS integration