Stack Monitors

Monitor Microsoft Azure with Crowswatch

Monitor VM health, App Service metrics, and Azure CDN analytics across your Azure subscriptions directly from Crowswatch.

What This Integration Provides

Virtual Machines: CPU, memory, disk, and network metrics per VM
App Service: request count, response time, error rate, and HTTP code breakdown
Azure CDN: request volume, cache hit rate, and egress
Azure Monitor alerts: active alert rule state across your subscription
Azure SQL: connection count, query latency, and DTU usage
Resource health: overall health status of monitored resources

Requirements

Requirement	Detail
Azure account	Any tier
App registration	A service principal in Microsoft Entra ID
Monitoring Reader role	Assigned to the service principal on your subscription
Tenant ID	Found in Microsoft Entra ID
Client ID	Found on the App registration overview
Client Secret	Created in the App registration credentials
Subscription ID	Found in the Azure Subscriptions list
Estimated setup time	~15 minutes

Step 1: Generate Credentials

Azure uses a service principal (an app registration in Microsoft Entra ID) with a client secret for programmatic authentication.

Register an application:

Go to the Microsoft Entra admin center
Navigate to Entra ID → App registrations → New registration
Enter a name (e.g. crowswatch-monitor)
Select Accounts in this organizational directory only
Click Register

Create a client secret:

In your new app registration, go to Certificates & secrets → Client secrets → New client secret
Enter a description and choose an expiry period
Click Add
Copy the Value immediately, as it is only shown once

Do not copy the Secret ID. You need the Value (the longer string).

Step 2: Locate Required IDs

Tenant ID and Client ID

Open your app registration in the Entra admin center
On the Overview page, copy:
- Directory (tenant) ID → this is your Tenant ID
- Application (client) ID → this is your Client ID

Subscription ID

In the Azure portal, search for Subscriptions
The Subscription ID is listed in the results table

Assign Monitoring Reader role:

In the Azure portal, go to Subscriptions → [your subscription] → Access control (IAM)
Click Add → Add role assignment
In the Role tab, search for and select Monitoring Reader
In the Members tab, click Select members, search for your app registration name, and select it
Click Review + assign

Monitoring Reader is a built-in Azure role that grants read-only access to all Azure Monitor data (metrics, logs, alert rules, and activity logs) without the ability to modify resources.

Step 3: Add Credentials to Crowswatch

Navigate to: Crowswatch → Add Service → Microsoft Azure

Field	Value
Tenant ID	Your Microsoft Entra Directory (tenant) ID
Client ID	Your App registration Application (client) ID
Client Secret	The secret Value from Step 1
Subscription ID	Your Azure Subscription ID

Available Metrics

Virtual Machines

CPU utilisation (%)
Available memory (bytes)
Disk read/write throughput
Network in/out (bytes)
VM availability status

App Service

Request count
Average response time (ms)
HTTP 4xx / 5xx error count
Data in / data out (bytes)
CPU time (seconds)

Azure CDN

Request count
Cache hit ratio (%)
Total egress (bytes)
Response time (ms)
Origin health

Azure SQL

DTU / vCore utilisation (%)
Active connections
Failed connections
Storage used (bytes)

Alerts

Active alert count by severity
Alert rule state (Fired / Resolved)
Recently fired alerts

Connect

Enter your Tenant ID, Client ID, Client Secret, and Subscription ID
Click Verify to confirm the credentials are valid
Select the resource types and metrics you want to track
Click Connect

Security

The Monitoring Reader role is read-only. It cannot create, modify, or delete Azure resources
Do not assign broader roles (e.g. Contributor or Owner) to the service principal
Set a short expiry on the client secret and rotate it before it expires
Consider scoping the Monitoring Reader role to a specific resource group rather than the full subscription if you only need to monitor a subset of resources

Troubleshooting

Authentication error (AADSTS errors)

Verify the Tenant ID, Client ID, and Client Secret are all correct. Confirm the client secret has not expired by checking Certificates & secrets in the app registration. Ensure you copied the secret Value, not the Secret ID.

No metrics appearing

Confirm the Monitoring Reader role is assigned on the correct subscription. Check that the app registration is in the same Entra tenant as the subscription.

Partial resource coverage

If you assigned the role at the resource group level, only resources in that group will be visible. For full subscription coverage, assign the role at the subscription level.

Client secret expired

Go to Entra ID → App registrations → [your app] → Certificates & secrets. Create a new client secret, copy the Value, and update it in Crowswatch.