Lucidscale allows you to import cloud infrastructure data from Azure and generate diagrams from that data in a Lucidscale model.

To learn more about functionality available with a Lucidscale license, see our Lucidscale Plans article. To purchase a license, view our pricing page.

Watch: Import Azure cloud architecture

Supported resources and lines

Lucidscale supports the following Azure resources:

API Management
App Services (Web Apps + API Apps)
Application Security Groups (ASGs)
Azure CDN profiles
Azure Express Route Circuits
Azure File Share
Azure Managed Identity
Azure Storage Queues Queues
Azure SQL Database [SQL Managed Instance]
Cache For Redis
Compute (Virtual Machines, Virtual Machine Scale Sets)
Connection
Cosmos DB Account
Databricks Workspaces
Data Factory
Disks
DNS Zones
Event Hubs
Event Hub Namespaces
Firewalls
Front door
Front Door Standard/Premium – (codename “FrontDoorAFD”)
- and its metadata: Endpoints, OriginGroups, Origins
Functions
Gov Cloud
HDInsight Clusters
Iot Hubs
Key Vault
Local Network Gateway
Log Analytics Workspaces
Logic App Workflows
MySQL (Databases)
Network (Application Gateways, Load Balancers, Subnets, Virtual Networks)
Network Security Groups (NSGs)
NSG
PostgreSQL (Databases)
Private Endpoints (CosmosDB, Service Bus, Functions, Keyvault, Webapps)
Route Tables
Service Bus
SQL (Databases)
Storage (Storage Accounts)
Traffic Manager Profiles
Virtual Network Gateway
Virtual Network Peering
Virtual WANs

Lucidscale can draw lines between resources that explicitly reference another in the metadata:

Application Gateway → Virtual Machines
Application Gateway → Virtual Machine Scale Sets
Application Gateway → App Services
Front Door → App Service
Front Door → Application Gateway
Front Door → Traffic manager profile
Front Door Standard/Premium → Application Gateway
Front Door Standard/Premium → Traffic Manager Profiles
Front Door Standard/Premium → Web Applications
Load Balancer → Virtual Machine
Virtual Machines → Disk
Virtual Network Gateway → Local Network Gateway
Virtual Network Gateway → Virtual Network Gateway
Virtual Network Peering Lines [VNET → VNET]

Note: If you elect to summarize resources within a Lucidscale View, you need to un-summarize them in order for your lines to be rendered in the model.

Import Azure infrastructure

You can import your Azure Cloud Infrastructure using one of the two methods: providing an Entra ID (formerly Azure AD) application attached to a role with the proper policies; or running a script from your Command Line Interface (CLI).

If you are working with a very large environment when using AD Applications, the information in the Subscription Configuration section of this article can help to reduce the amount of data you are importing or reduce the number of API calls Lucidscale makes to Azure. The Data Hub supports up to five concurrent imports. To import more than five subscriptions, you will need to wait for one to finish and then start another.

Note: If you import using the AD application method, Lucidscale saves your AD applications in the Data Hub so you can use them in the future without having to re-enter your information.

To render your Azure infrastructure in a Lucidscale model:

Click + New on the Lucid Home Page.
Hover your cursor over Lucidscale.
Select Azure.
From the Data Hub, click + New Subscription and choose an import method.
- After completing the import, the subscription will be listed as a data source in the "Azure: Imported Subscriptions" section of the Data Hub. You can also find it listed as an imported Azure subscription in the modal after clicking + New > Lucidscale > Azure.
To create a new model, click the three-dot menu next to the account you want to create a model from.
Select Create new model.
Review the details of your model and add optional filters to exclude unnecessary resources.
Select Create Azure Model.

The Lucidscale model will generate in the background of your Lucid account. We will notify you once it has been rendered through the status modal that appears in the bottom-right of the page.

You can open the model from the status modal that renders directly after creating a new model. The model (and previously created models) will also be stored and accessible in the "Documents" section of your Lucid Home Page after you generate it.

open_a_newly_created_lucidscale_model_from_azure_data.png

Learn more: Check out our article to learn how to work with your Azure architecture in a Lucidscale model once it is rendered.

Import via AD application (recommended)

To import your Azure infrastructure via AD application and render a Lucidscale model, follow these steps:

Step 1: Register a new application

On the Lucid Home Page, click + New.
Hover your cursor over Lucidscale.
Select Azure.
From the Data Hub, click + New Subscription.
Select Azure AD Application.
Click Create a new AD Application.
Select Register AD Application (this will open a new tab). Leave the Lucid browser tab open so you can return to it later.
In the new browser tab, log in to your Azure account.
Register a new Azure AD application in the Azure portal by selecting App Registrations, then clicking New registration.
Give a name to the application and leave the remaining settings as default.
Click Register.
Copy the "Application (client) ID" by clicking the copy to clipboard icon.
Navigate back to the Lucid browser tab you left open in step nine.
Under “Assign a role the AD Application”, select one of the following options:
- Use a read-only role for all resources (Recommended)
- Create a custom role with minimum permissions

Use a read-only role for all resources (Recommended)

In the "Access Control (IAM)" section of your Subscription or Management Group, start adding a role assignment. Search and select the Reader role, and assign access to the AD Application you registered earlier.
In your open Lucid tab under “Add the AD Application to Lucidscale”, select an AD Application Type depending on where your Azure instance resides.
Type a nickname value into the "Application Name" field.
Paste the copied ID into the "Application (client) ID" field in the modal.
Copy and past the value for "Directory (tenant) ID" from the newly created app into it's respective field in the modal on your open Lucid tab.
Navigate back to your Azure tab and click Certificates & Secrets.
Click + New client secret.
Enter a description for the client secret.
Select the expiration value.
Click Add.
Copy the value of the newly generated secret by clicking the copy to clipboard icon to the right of the "Value" field.
Navigate back to your open Lucid tab and paste the secret value into the "Client secret value" field.
Type a nickname value into the "Application Name" field.
Click Next.

Create a custom role with minimum permissions

In the “New AD application” modal in Lucid, click Download permission JSON to download the JSON permission file.
Navigate to your Azure browser tab and click Subscriptions on the home screen.
Select the subscriptions you want to import.
Click Access Control (IAM).
Click +Add and Add custom role.
Select the Start from JSON option and upload the JSON permission file that you downloaded from the Lucid tab to your computer.
Enter a value into the "Custom role name" field.
- This helps you identify it as the role for Lucidscale.
Click Next.
On the "Permissions" page, click Next.
On the "Assignable scopes" page, click Add assignable scopes.
Select the subscription from the Subscription drop-down, select the Subscription from the right-hand menu to add it to the assignable scopes, and then click Add.
Click Next on the "Assignable scopes" page.
Click Next on the "JSON page".
Click Create on the "Review + create" page to finish configuring your custom role.
Return to the subscription import you started in (selected in step 3 above).

Step 3: Set a role assignment

In the subscription you started in, click Role Assignments.
Click + Add and Add role assignment.
Populate the following values in the rendered “Add role assignment” modal:
1. Role: The custom role you just created.
2. Assign access to: leave default value (“User, group, or service principal”).
3. Select: The AD application you created previously.
  - If your AD app isn’t rendering in the Select field drop-down, try typing the name of the app you created directly within the Select field.
Click Save to complete the role assignment.

Step 4: Add your AD application to the Data Hub

Navigate back to your Lucid tab and click Next in the “New AD application” modal.
Click Add Azure AD Application.
- If everything has been configured correctly, your AD application, credentials, and subscriptions will be validated to then display the AD application in the “Saved Credentials” modal.
Select the AD application and click Next.

Step 5: Import subscriptions and create models

Select the subscription(s) you want to use to import and generate a Lucidscale model.
Click Next.
- You can omit chosen resource types or metadata from your import by deselecting them. Deselected resource types and metadata will not be imported or rendered in your model created from the subscription(s). See the subscription configuration details at the end of this section for more information.
Click Import Azure Subscription.
- After completing the import, the subscription will be listed as a data source in the "Azure: Imported Subscriptions" section of the Data Hub. You can also find it listed as an imported Azure subscription in the modal after clicking + New > Lucidscale > Azure.
From the Data Hub, click the three-dot menu next to the account you want to create a model from.
Add a name, select views, and review subscriptions. You can also Filter to exclude unnecessary resources at this step.
Select Create Azure Model.
- The Lucidscale model will generate in the background of your Lucid account. We will notify you once it has been rendered through the status modal that appears in the bottom-right of the page.

Learn more: To learn how to work with your Azure architecture in a Lucidscale model once it is rendered, check out the linked article.

Subscription configuration

When importing an Azure subscription to the Lucid Data Hub using the AD application method, you have the option to omit chosen resource types or metadata from your import. This grants you the ability to visualize only resource types you’re interested in and in some cases can increase the speed of your import. Deselected resource types and metadata will not be imported or rendered in your diagram.

Import via Azure Management Group

To import your Azure infrastructure via Azure Management Group and render a Lucidscale model, follow these steps:

Step 1: Register a new application

On the Lucid Home Page, click + New.
Hover your cursor over Lucidscale.
Select Azure.
Click Open Data Hub to import and render a new subscription.
- You can also create a model from an existing Azure subscription.
Click + New Subscription.
Select Azure AD Application.
Click Create a new AD Application.
Select Global Azure Application or Azure Government Application depending on where your Azure instance resides. Leave this tab open so you can return to it later.
In a new browser tab, log in to your Azure account.
Register a new Azure AD application in the Azure portal by selecting App Registrations, then clicking New registration.
Give a name to the application and leave the remaining settings as default.
Click Register.
Copy the "Application (client) ID" by clicking the copy to clipboard icon.
Paste the copied ID into the "Application (client) ID" field in the modal on the open Lucid browser tab.
Copy the values for "Application (client) ID" and "Directory (tenant) ID" from the newly created app and paste them into their respective fields in the modal in your open Lucid tab.
Navigate back to your Azure tab and click Certificates & Secrets.
Click + New client secret.
Enter a description for the client secret and select the expiration value.
Click Add.
Copy the value of the newly generated secret by clicking the copy to clipboard icon to the right of the "Value" field.
Navigate back to your open Lucid tab and paste the secret value into the "Client Secret" field.
Type a nickname value into the "Application Name" field.
Click Next.

Step 2: Create a custom role

In the “New AD Application” modal, click Download Permission JSON to download the JSON permission file.
Navigate to your Azure browser tab and scroll to "Management Groups".
Select the management group you want in scope for the AD application.
Click Access Control (IAM).
Click + Add and select Add custom role.
Select Start from JSON and upload the JSON permission file that you downloaded from the Lucid tab to your computer.
Enter a value into the "Custom role name" field that helps you identify it as the role for Lucidscale and click Next.
On the "Permissions" page, click Next.
On the "Assignable scopes" page, click Add assignable scopes.
Select the type as “Management Group" and select the target management group you want in scope for Lucidscale.
- If step 10 is completed correctly, you will be able to import all the subscriptions within your management group into Lucidscale.
Click Next on the "Assignable scopes" page.
Click Next on the "JSON" page.
Click Create on the "Review + create" page to finish configuring your custom role.
Return to the Management Group you started in.

Step 3: Set role assignment

In the Management Group that you started in, click Role Assignments.
Click + Add and then Add role assignment.
Populate the following values in the rendered “Add role assignment” modal:
1. Role: The custom role you just created.
2. Assign access to: leave default value (“User, group, or service principal”).
3. Select: The AD application you created previously.
  - If your AD app isn’t rendering in the Select field drop-down, try typing the name of the app you created directly within the Select field.
Click Save to complete the role assignment.

Import via Azure CLI

Install Python if you don't have it already. More detailed instructions can be found here. Ensure you check the option “Add Python to PATH” in the installer. You can verify that Python was properly installed by trying the commands “python” or “python 3” in a terminal (MAC OS) or Command Prompt (Windows).

On the Lucid Home Page, click + New.
Hover your cursor over Lucidscale.
Select Azure.
Click Open Data Hub to import and render a new subscription.
- You can also create a model from an existing Azure subscription.
Click + New Subscription.
Select Azure CLI Script.
Select Global Azure Application or Azure Government Application depending on where your Azure instance resides. Leave this tab open so you can return to it later.
Install the Azure CLI.
Click Download requirements.txt.
Run the following command: pip3 (pip) install -r requirements.
- This will install the necessary Azure packages that enable the Lucidscale script to generate a JSON file for your import.
On your terminal, run the command: az login.
- Running this command gives the Azure SDK access to the Active Directory. If you want to import a different directory, switch the Active Directory in the Azure portal and re-run az login.
Click Download azurecliscript.py
Scroll to the downloaded location of the script, and run the command: python3 (python) azurecliscript.py --subscriptions “subscription id 1” “subscription id 2”.
Return to your Lucid tab and upload the azure.json generated from the script by clicking Choose File and selecting it.
Click Next.
Specify an alias name for your subscription.
Click Next.
After completing the import, the subscription can be found in the "Azure: Imported Subscriptions" section of the Data Hub
- It will also be found by clicking + New > Lucidscale > Azure.
Click Create new model.
Review the details of your model including adding optional filters.
Select Create Azure Model.
- The Lucidscale model will generate in the background of your Lucid account. We will notify you once it has been rendered through the status modal that appears in the bottom-right of the page.

Learn more: To learn how to work with your Azure architecture in a Lucidscale model once it is rendered, check out the linked article.

Use the Data Hub to manage Azure infrastructure data and credentials

Imported subscriptions

After importing Azure subscription data, it will be listed as a data source with the subscription name you specified in the "Azure: Imported Subscriptions" section of the Data Hub. From this section you can also click + New Subscription to import a new subscription to the Data Hub.

Subscriptions listed in this section are data sources that can be used to create new Lucidscale models. Data sources (“Subscriptions”) contain the Azure subscription metadata used to create Lucidscale models. The “Last updated” field indicates when your data source was last refreshed to account for any updates in your connected Azure subscription.

azure_data_hub_overview_showing_all_subscription_options.png

The Cloud Inventory of each subscription can be seen on the right-hand side after selecting a subscription from the list. This inventory allows you to see a full count of each type of resource that has been imported before creating a model. You can also download a CSV with the list of resources and count directly from the Data Hub by clicking Download CSV.

The inventory lists all resources that can be accessed by the role permissions assigned to your AD application. If you elect to “Use a read-only role for all resources”, all resources in your subscription which are accessible by Azure’s “Reader” role will be rendered in the inventory. If you create a custom role, only the resource types specified in your assigned role permissions will be rendered in the inventory.

Click the three-dot menu rendered on a subscription to access the following potential options:

Create new model begins rendering the Azure infrastructure associated with the subscription as a diagram in a new model’s workspace. A model will be generated in the background of your Lucid Home Page and we will notify you once it has been rendered through the status modal that appears in the bottom-right of the page.
Update Subscription from Azure and Schedule update allow you to manually or automatically update the Azure subscription data you have imported to the Data Hub to reflect any changes in the connected Azure subscription. New models created from the subscription after the update will reflect any changes in the connected Azure subscription.

Learn more: Refer to our Update and sync data in Lucidscale article to learn more.

Edit resources will allow you to edit the resources included in each dataset. Selecting this option will open up a modal in which you can add or remove any resources from your existing datasets. When you’ve finished with the selection, click Save and update Subscription. This will ensure that the dataset refreshes and models referencing that dataset are updated to the latest information.
Rename Subscription allows you to change the name of the selected dataset.
Delete Subscription removes the imported subscription from the Lucid Data Hub. Any models created from that subscription will lose the ability to update data from Azure.

Note: The options displayed above will vary depending on the import method you’ve used for a subscription. The update option is only available with AD Application import. CLI imports do not support this option.

Saved credentials

The Saved Credentials page in Data Hub is where you can find all the AD applications you can use to import Azure subscriptions to the Data Hub. From this page, click + New AD application to add a new set of credentials that can be used to import an Azure Subscription.

To share the AD applications you have created with other users, click the three-dot menu rendered on an AD application.

From here, you have two potential options:

Share credential opens a modal that allows you to share an AD application you created with another user on your Lucid account by specifying their email address. Granting them access to the AD application allows them to import the associated Azure subscription(s) to the Data Hub and create Lucidscale models. After a credential has been shared with another user, you can revoke their access to the credential by clicking the X next to their email address in the same modal.
Delete credential removes your AD application from the Data Hub. After deleting a credential, all subscriptions previously imported with that credential, along with models created from those subscriptions, lose the ability to update data from Azure.

Learn more: You can only share credentials in the Data Hub that you own. Only Lucidscale users assigned a Creator license can import accounts and create models. For more details check out our Credential management, usage, and security in Lucidscale article.

Security information

Azure AD application

Entra ID (formerly Azure AD) application is the preferred method from Azure for managing digital identities for both external and on-premises applications.

This method allows Lucidscale to securely store credentials that allow you to easily import and refresh your diagram.

See these resources for more information:

Secure, limited access

Lucid requests limited, read-only access permission for the Azure AD Application you create. The permissions are defined within the custom role you tie to your application. A custom role created with these permissions cannot change settings in your Azure architecture or read data in your databases. Lucid only uses the AD Application to read the structural metadata of your Azure infrastructure. Lucid only reads from subscriptions that you grant us access to; you can control that by limiting the scope of the custom role attached to the AD application assigned to Lucidscale.

CLI script alternative

To review and control the actions Lucid takes during our Azure infrastructure scan, you can download and use our provided Python script instead of creating an Azure AD application. In this scenario, your credentials will never be passed to Lucidscale, and you can review both the code that will run in your environment and the resulting metadata before uploading the metadata to Lucidscale. Your imported JSON will be accessible in the Lucid Data Hub to use for creating Lucidscale models.

Safe storage of documents (models)

Lucidscale stores Azure imported metadata and generated models using industry standard protections for confidential data. Imported Azure data is embedded as part of the Lucidscale model, so you can control access to the data using Lucid’s standard sharing permissions. For additional information regarding how Lucid protects your documents, refer to our Content Security page or contact our sales team.

FAQ

Once Lucidscale is purchased, will every user on the account have access?

If you are an existing Lucid customer (currently have a Lucidchart or Lucidspark subscription), depending on your licensing settings it is possible not all users on the account will have access to Lucidscale by default. An account admin may need to assign the Lucidscale licenses purchased to individual users or groups through the Users section of the Admin Panel in the same manner as Lucidchart and Lucidspark. Users added to an account that only has a Lucidscale Team subscription (no current Lucidchart or Lucidspark subscriptions) will be automatically assigned either a Creator or Explorer license depending on which licenses have been purchased. For instructions on how to grant licenses, check out Lucid admin panel: License settings article.

How does Lucidscale get access to our Azure environment? What level of access does Lucidscale have?

The recommended method from Lucidscale and Azure is through an Azure AD Application. We provide a policy which gives us “describe and list” access to your environment so we can get an inventory of resources.

We also have a method using a python script you can run through the Command Line Interface (CLI) which generates a JSON file. Users can then upload this JSON file to Lucidscale and not populate any credential information into Lucidscale.

What APIs does Lucidscale access?

We primarily use describe and list API endpoints.

Can I choose which metadata (the fields and values shown in the Data panel) is imported? If not, what metadata is imported?

No, you can't currently choose what metadata is imported. However, we are looking to create some ability to do that in the future. All metadata from a describe API call is imported.

Give feedback on this article

Have feedback about this article? Tell us about your experience here.

Related articles