Lucidscale allows you to import cloud infrastructure data from Azure and generate diagrams from that data in a Lucidscale model.

Lucidscale is available to Lucid Suite Enterprise accounts as an add-on purchase with the Cloud Accelerator. To learn more about the Cloud Accelerator, refer to our Cloud Accelerator overview article.

Watch: Import Azure cloud architecture

Supported Azure environments, resources, and lines

For a comprehensive list of the supported environments, resources, and lines from Azure that are available in Lucidscale refer to our Supported Azure environments, resources, and lines article.

Import Azure infrastructure

You can import your Azure cloud infrastructure data using one of the two following methods:

Trusted access: This method uses a single Enterprise Application (formerly Azure AD), which may be assigned to one (or more) Azure management groups or to one (or more) individual Azure subscriptions. Import permissions are granted via a read-only role that is assigned to this application.
File upload: This method uses a Lucid-provided Python script in a configured Azure CLI terminal to generate a JSON file of your infrastructure data for manual upload.

Check out the following table for specifics on each method and to determine which is best for your use case.

Import method	Description	Scope	Resource support types*	Data refresh**
Trusted access: management group	Provide a single Enterprise Application with an IAM role assignment for one or more management groups.	Centrally manage imports for multiple Azure subscriptions within a management group via a single credential.	(1) and (2)	Automatic and Manual
Trusted access: individual subscriptions	Provide a single Enterprise Application with an IAM role assignment for one or more subscriptions.	Register a credential for one or more individual Azure subscriptions.	(1) and (2)	Automatic and Manual
File upload	Run a Lucid-provided Python script in a configured Azure CLI terminal, then upload the generated JSON file to Lucid.	Up to 50 subscriptions per JSON file.	(1) only	Manual Refresh data by uploading a newly generated JSON file.

*Resource type 1 (mapped resources): All resources listed in the Supported resource section above. Resource type 2 (unmapped resources): Abroad variety of resources you can place manually in your models or access via Cloud Inventory in the data hub.
**Automatic data source refreshes are available for users to set on a recurring schedule (daily, weekly, monthly, yearly) via the data hub. Manual refreshes are performed with a single click in the data hub.

Lucid saves trusted access credentials so you can refresh your data or start new imports without re-entering your information. This storage capability allows Lucid to perform the automatic data refreshes. Credentials can be deleted via the Azure Data hub credentials tab.

If you are working with a very large environment, use the information in the Optimize performance in Lucidscale article to reduce the amount of data you are importing, or reduce the number of API calls Lucid makes to Azure. Lucid supports up to 50 concurrent subscription imports per user. After each import finishes, you can start a new import.

Import via trusted access

This method provides secure, ongoing access by registering an Enterprise Application with read-only permissions. With trusted access, Lucid saves your credentials, allowing you to perform both manual and scheduled automatic data refreshes.

Step 1: Create and register an enterprise application in Azure

First, you will create and register the application within your Azure portal. This application will act as the service principal that Lucid uses to authenticate.

Navigate to the Lucid Home Page.
Click Data hub from the bottom of the navigation menu on the left-hand side of the page.
From the providers list in the data hub, click Azure.
Select Import Azure data.
Select Trusted access.
Under credential scope, choose either "management group" or "individual subscription". If you’ve previously registered a credential, you’ll be directed to the credential selection page first.
Click Register a new credential at the top of this page.
After selecting the credential scope, select Register AD application.This will direct you to a new tab with the application registration page in Azure (if already signed into Azure). Leave the Lucid browser tab open.
- For environments in Azure Government, select the link directly below it instead.
On the registration page in Azure, add a name for the application and keep the default settings for all remaining fields.
Click Register to complete the registration of your Enterprise Application.
Go to App registrations in Microsoft Entra ID and select the application you just registered.
Under Properties, copy the “Application (client) ID” by clicking the copy-to-clipboard icon.
- Back in your Lucid tab, paste this value in the “Application (client) ID” field.
- Repeat this process for the “Directory (tenant) ID”.
In your Azure tab, select Manage in the left-hand navigation menu.
Select Certificates & secrets.
Click + New client secret.
Provide a description, select an expiration period, and click Add.
Copy the new secret's Value immediately since this value is only displayed once. Back in your Lucid tab, paste this value in Step 3’s field “Client secret value”.

Note: Azure requires an expiration period for client secrets. Once your client secret expires, Lucid can't import or refresh your Azure data. You can set this expiration for up to two years, though Azure recommends six months. To continue with imports after expiration, you'll need to generate a new client secret in Azure and then update the credential in your Lucid data hub with the new value.

Step 2: Assign a role to the enterprise application

After creating the application, you must grant it permissions to read your Azure environment's metadata. You have two options: assigning a built-in, read-only role (recommended) or creating a custom role with minimum required permissions. These two options are listed under Step 2: “Assign a role to the AD application”.

azure_ad_application_roles

Option A: Use a read-only role for all resources (Recommended)

Lucid recommends using Azure's built-in role for read-only access, as new Azure resources are automatically added and become available for Lucid imports. This approach grants the application read-only access to all resources within the specified scope (either a Management Group or a specific Subscription).

In the Azure portal, navigate to the Subscription or Management Group you wish to import.
Select Access control (IAM) from the navigation menu.
Click + Add.
Choose Add role assignment.
On the Role tab, search for and select the built-in Reader role.
Navigate to the Members tab.
Click + Select members and search for the name of the Enterprise Application you registered earlier.
Select the application.
Click Save.
Click Review + create to complete the role assignment.

Option B: Create and assign a custom role

In this approach, you create a role with the exact minimum permissions required for an import.

In your Lucid tab, go to step 2 and select the “Custom role” option.
Click Download JSON file to save the role baseline permissions file.
In the Azure portal, navigate to the Subscription or Management Group you want to import.
Go to Access control (IAM).
Select + Add > Add custom role.
Next to Baseline permission.
Choose Start from JSON and upload the file you downloaded from Lucid.
Give the role a descriptive Custom role name, such as Lucid Minimum Read Access.
On the Assignable scopes tab, verify that your target subscription or Management Group is listed. If not, select + Add assignable scopes.
- For Management group level imports, set the Type to Management Group and select each group you’d like to import.
- For individual subscription level imports, set the Type to Subscription and select each subscription you’d like to import.
Click Review + create.
Select Create to finalize the custom role.
In the Access control (IAM) settings of your subscription or Management Group.
Click + Add.
Select Add role assignment.
- For the Role, search for and select the custom role you just created.
- For Assign access to, leave the default value (User, group, or service principal).
- For Select, find and choose the Enterprise Application you registered.
- Click Save to apply the role assignment.

Step 3: Add credentials and import subscriptions to data hub

Finally, you will provide the application credentials to Lucid to validate the connection.

Return to the Lucid tab you previously left open.
1. If your application was created in Azure Government, update the “AD Application Type” to “Azure Government application”.
Enter a display name for the credential so you can identify it later. This will go in the “AD Application display name” field.
Click Next.
Check the boxes for the subscription(s) you wish to import.
Click Next.
Select the resource types you wish to import.
- When importing subscriptions to the Lucid data hub, you have the option to omit chosen resource types or metadata from the import. This grants you the ability to visualize only resource types you’re interested in and, in some cases, can increase the speed of the import. Deselected resource types and metadata will not be imported or visualized in a diagram.
- For subscriptions with a large number of resources, see Optimize performance in Lucidscale to enhance your product experience.
- For credentials with more than 1 subscription, the configuration for metadata and resource types being omitted will apply to all subscriptions listed in the “Import Summary” section.
(Optional) Customize the name of each Azure subscription. Additionally, you can add prefix text to all listed subscriptions.
Click Import Azure subscriptions.

File upload

To import Azure infrastructure via a JSON file upload, follow these steps:

On the Lucid Home Page, click Data hub in the left-hand navigation menu.
Select Import Azure data.
Choose File upload.
Select Global Azure Application or Azure Government Application depending on where your Azure instance resides. Leave this tab open so you can return to it later.
Click Download requirements.txt and Download script.
Configure your Azure CLI using the requirements.txt file and the instructions listed at the beginning of the azurecliscript.py file.
1. For more configuration instructions, see Azure File Upload Script Description section below.
Execute the Python script in your Azure CLI. An azure.json file will be generated.
In the Lucid data hub tab, select Choose file and upload the azure.json file.
Click Next.
Provide an alias name for each subscription you’d like to import.
Select Import Azure subscriptions.

Azure File Upload script description

The Lucid-provided import script, azurecliscript.py, leverages the Azure CLI and Azure SDK for Python to collect your Azure resource configuration. It requires proper authentication and specific subscription selection.

The script uses AzureCliCredential for authentication, relying on your active Azure CLI session established with az login. Your credentials from az login grant access to your Microsoft Entra ID (Active Directory) tenant.

If you are retrieving data from Azure Government Cloud, first set the cloud environment: az cloud set --name AzureUSGovernment.
Otherwise, for Global Azure, ensure the cloud environment is set to AzureCloud: az cloud set --name AzureCloud.

For detailed documentation on managing Azure subscriptions and authentication with the Azure CLI, refer to Azure's documentation on Manage Azure subscriptions with the Azure CLI and Sign in with Azure CLI.

Requirements:

Python: Versions 3.0-3.9. Ensure "Add Python to PATH" is selected during installation.
Azure CLI: Installed and configured.
Azure SDK Packages: The script requires specific Azure SDK packages (e.g., azure.mgmt.compute, azure.mgmt.network, etc.). These are installed by running pip3 install -r requirements.txt after downloading requirements.txt from the data hub.

Parameters:

-s, --subscriptions [REQUIRED]
- Specifies one or more Azure subscription IDs from which to import resources. This option can be repeated to import from multiple subscriptions within your authenticated Azure CLI session.
-o, --output
- Specifies the filename for the generated output JSON. If not specified, the default filename azure.json will be used.
-c, --count
- Outputs a JSON file named count.json containing a count of resources. When this flag is used, the generated JSON file is not suitable for Lucid imports.

Example:

python3 azurecliscript.py --subscriptions "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" --output my_azure_data.json

The command above runs the script and generates a JSON file named my_azure_data.json for resources residing in the specified Azure subscriptions.

Use the Data Hub to manage Azure infrastructure data and credentials

Imported subscriptions

After importing Azure subscription data, it will be listed as a data source with the subscription name you specified in the "Azure: Imported Subscriptions" section of the Data Hub. From this section you can also click + New Subscription to import a new subscription to the Data Hub.

Subscriptions listed in this section are data sources that can be used to create new Lucidscale models. Data sources (“Subscriptions”) contain the Azure subscription metadata used to create Lucidscale models. The “Last updated” field indicates when your data source was last refreshed to account for any updates in your connected Azure subscription.

azure_data_hub_overview_showing_all_subscription_options.png

The Cloud Inventory of each subscription can be seen on the right-hand side after selecting a subscription from the list. This inventory allows you to see a full count of each type of resource that has been imported before creating a model. You can also download a CSV with the list of resources and count directly from the Data Hub by clicking Download CSV.

The inventory lists all resources that can be accessed by the role permissions assigned to your AD application. If you elect to “Use a read-only role for all resources”, all resources in your subscription which are accessible by Azure’s “Reader” role will be rendered in the inventory. If you create a custom role, only the resource types specified in your assigned role permissions will be rendered in the inventory.

Click the three-dot menu rendered on a subscription to access the following potential options:

Create new model begins rendering the Azure infrastructure associated with the subscription as a diagram in a new model’s workspace. A model will be generated in the background of your Lucid Home Page and we will notify you once it has been rendered through the status modal that appears in the bottom-right of the page.
Update Subscription from Azure and Schedule update allow you to manually or automatically update the Azure subscription data you have imported to the Data Hub to reflect any changes in the connected Azure subscription. New models created from the subscription after the update will reflect any changes in the connected Azure subscription.

Learn more: Refer to our Update and sync data in Lucidscale article to learn more.

Edit resources will allow you to edit the resources included in each dataset. Selecting this option will open up a modal in which you can add or remove any resources from your existing datasets. When you’ve finished with the selection, click Save and update Subscription. This will ensure that the dataset refreshes and models referencing that dataset are updated to the latest information.
Rename Subscription allows you to change the name of the selected dataset.
Delete Subscription removes the imported subscription from the Lucid Data Hub. Any models created from that subscription will lose the ability to update data from Azure.

Note: The options displayed above will vary depending on the import method you’ve used for a subscription. The update option is only available with AD Application import. CLI imports do not support this option.

Saved credentials

The Saved Credentials page in Data Hub is where you can find all the AD applications you can use to import Azure subscriptions to the Data Hub. From this page, click + New AD application to add a new set of credentials that can be used to import an Azure Subscription.

To share the AD applications you have created with other users, click the three-dot menu rendered on an AD application.

From here, you have two potential options:

Share credential opens a modal that allows you to share an AD application you created with another user on your Lucid account by specifying their email address. Granting them access to the AD application allows them to import the associated Azure subscription(s) to the Data Hub and create Lucidscale models. After a credential has been shared with another user, you can revoke their access to the credential by clicking the X next to their email address in the same modal.
Delete credential removes your AD application from the Data Hub. After deleting a credential, all subscriptions previously imported with that credential, along with models created from those subscriptions, lose the ability to update data from Azure.

Learn more: You can only share credentials in the Data Hub that you own. Only Lucidscale users assigned a Creator license can import accounts and create models. For more details check out our Credential management, usage, and security in Lucidscale article.

Security information

Azure AD application

Entra ID (formerly Azure AD) application is the preferred method from Azure for managing digital identities for both external and on-premises applications.

This method allows Lucidscale to securely store credentials that allow you to easily import and refresh your diagram.

See these resources for more information:

Secure, limited access

Lucid requests limited, read-only access permission for the Azure AD Application you create. The permissions are defined within the custom role you tie to your application. A custom role created with these permissions cannot change settings in your Azure architecture or read data in your databases. Lucid only uses the AD Application to read the structural metadata of your Azure infrastructure. Lucid only reads from subscriptions that you grant us access to; you can control that by limiting the scope of the custom role attached to the AD application assigned to Lucidscale.

CLI script alternative

To review and control the actions Lucid takes during our Azure infrastructure scan, you can download and use our provided Python script instead of creating an Azure AD application. In this scenario, your credentials will never be passed to Lucidscale, and you can review both the code that will run in your environment and the resulting metadata before uploading the metadata to Lucidscale. Your imported JSON will be accessible in the Lucid Data Hub to use for creating Lucidscale models.

Safe storage of documents (models)

Lucidscale stores Azure imported metadata and generated models using industry standard protections for confidential data. Imported Azure data is embedded as part of the Lucidscale model, so you can control access to the data using Lucid’s standard sharing permissions. For additional information regarding how Lucid protects your documents, refer to our Content Security page or contact our sales team.

FAQ

Once Lucidscale is purchased, will every user on the account have access?

If you are an existing Lucid customer (currently have a Lucidchart or Lucidspark subscription), depending on your licensing settings it is possible not all users on the account will have access to Lucidscale by default. An account admin may need to assign the Lucidscale licenses purchased to individual users or groups through the Users section of the Admin Panel in the same manner as Lucidchart and Lucidspark. Users added to an account that only has a Lucidscale Team subscription (no current Lucidchart or Lucidspark subscriptions) will be automatically assigned either a Creator or Explorer license depending on which licenses have been purchased. For instructions on how to grant licenses, check out Lucid admin panel: License settings article.

How does Lucidscale get access to our Azure environment? What level of access does Lucidscale have?

The recommended method from Lucidscale and Azure is through an Azure AD Application. We provide a policy which gives us “describe and list” access to your environment so we can get an inventory of resources.

We also have a method using a python script you can run through the Command Line Interface (CLI) which generates a JSON file. Users can then upload this JSON file to Lucidscale and not populate any credential information into Lucidscale.

What APIs does Lucidscale access?

We primarily use describe and list API endpoints.

Can I choose which metadata (the fields and values shown in the Data panel) is imported? If not, what metadata is imported?

No, you can't currently choose what metadata is imported. However, we are looking to create some ability to do that in the future. All metadata from a describe API call is imported.

Give feedback on this article

Have feedback about this article? Tell us about your experience here.

Related articles