> For the complete documentation index, see [llms.txt](https://docs.archera.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.archera.ai/help-center/azure-onboarding/technical-onboarding/onboarding-using-azure-cli.md). # Onboarding using Azure CLI ## Manual CLI Setup Some enterprise Azure tenants enforce security policies that block Global Admin consent for OAuth-based third-party application provisioning. This page covers the CLI/RBAC onboarding path — Archera's alternative for restricted tenants. Instead of the standard OAuth authorization screen, a privileged admin in your organization downloads a pre-generated bash script from the Archera platform and runs it in Azure Cloud Shell or a local terminal. The script applies the required RBAC role assignments directly — no user-impersonation consent required. > **Note:** This path must be enabled for your organization by Archera support before you begin. If you haven't already confirmed this with your Archera contact, email . *** ### Prerequisites * An eligible Azure billing account type (Microsoft Customer Agreement, Microsoft Partner Agreement, or Enterprise Agreement). See Supported Account / Subscription Types. * The person running the script must have **Owner** or **User Access Administrator** on the target subscriptions. * **Access management for Azure resources** enabled in Microsoft Entra ID — required to create custom roles at tenant scope. See the Prerequisite Checklist. * Access to Azure Cloud Shell or a local terminal with the Azure CLI installed. *** ### Choosing Your Environment {% tabs %} {% tab title="Azure Cloud Shell (recommended)" %} Cloud Shell runs in your browser inside the Azure Portal and is pre-authenticated — no `az login` required. 1. Open the [Azure Portal](https://portal.azure.com) 2. Click the **Cloud Shell** icon (`>_`) in the top navigation bar 3. Select **Bash** when prompted 4. Proceed to Download and Run the Script {% endtab %} {% tab title="Local Azure CLI" %} If running locally: 1. Install the [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) 2. Sign in to the correct tenant: `az login --tenant ` 3. Proceed to Download and Run the Script {% endtab %} {% endtabs %} *** ### Download and Run the Script #### Step 1 — Select the CLI/RBAC path in the onboarding wizard When you reach the authorization step in the Archera onboarding flow, you will see two options: * **Standard OAuth** — for tenants without Global Admin consent restrictions * **CLI/RBAC script** — for restricted tenants Select **CLI/RBAC script**.
#### Step 2 — Download the generated script Archera generates a bash script pre-populated with your organization's tenant ID, subscription IDs, and Archera's service principal. Download it from the onboarding screen.
#### Step 3 — Run the script The platform provides run instructions for both environments: **Azure Cloud Shell (recommended)** 1. Launch [Cloud Shell](https://shell.azure.com) in Bash mode 2. Upload the script via **Manage files → Upload** 3. Run: `bash archera-azure-onboarding.sh` **Local terminal** 1. Ensure the Azure CLI is installed: `az --version` 2. Log in to the correct tenant: `az login --tenant ` 3. Run: `bash .sh` **The script will:** 1. Validate your Azure session and target subscriptions 2. Register the required resource providers 3. Create the Archera custom RBAC role at tenant scope 4. Assign the required built-in roles to Archera's service principal 5. Create the resource group and storage account for cost exports 6. Print a completion summary You will be asked to confirm before any resources are created. #### Step 4 — Verify completion Once the script finishes, return to the Archera platform. The onboarding wizard detects that the required permissions have been applied and advances automatically. Expected state after a successful run: * No outstanding permission errors in the wizard * Green confirmation state on the authorization step
If the wizard does not advance, refresh the page and allow **2–3 minutes** for Azure RBAC propagation before retrying. *** ### Role Summary The script assigns the following permissions to Archera's service principal: | Role | Scope | Purpose | | ----------------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------- | | Archera Custom Role (read) | Each selected subscription | Billing, cost management, resource reads | | Reader and Data Access | Storage account | SAS token generation for cost export reads | | Storage Blob Data Reader | Storage account | Direct blob read access | | User Access Administrator | Storage account | Grant write access to Cost Management export managed identity | | Reservation Reader | `/providers/Microsoft.Capacity` | Read existing Reserved Instances | | Reservation Purchaser | `/providers/Microsoft.Capacity` + management subscription | Purchase Reserved Instances | | Savings Plan Reader | `/providers/Microsoft.BillingBenefits` | Read existing Savings Plans | | Savings Plan Purchaser | `/providers/Microsoft.BillingBenefits` + management subscription | Purchase Savings Plans | | Advisor Recommendations Contributor | `/providers/Microsoft.Advisor` | Read Advisor recommendations | *** ### Troubleshooting **Script exits with a permissions error**\ The user running the script lacks sufficient rights to assign RBAC roles. Confirm the running account has **Owner** or **User Access Administrator** on the target subscriptions and that **Access management for Azure resources** is enabled in Microsoft Entra ID. **Wizard does not advance after the script completes**\ Allow 2–3 minutes for Azure RBAC propagation and refresh. If the issue persists, confirm the script ran against the correct subscriptions — a mismatch between the subscriptions Archera expects and what the script targeted is the most common cause. **CLI/RBAC option not visible in the onboarding wizard**\ This path requires a feature flag enabled by Archera on your account — it is not self-service. Contact your Archera representative or email to request it before attempting onboarding. *** ### Related Resources * Azure Onboarding — Prerequisite Checklist * Azure Onboarding — Required Permissions * How Does Archera Access My Azure Environment? * Azure Offboarding --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.archera.ai/help-center/azure-onboarding/technical-onboarding/onboarding-using-azure-cli.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.