Import and manage Azure infrastructure data in the Lucid Data Hub

Watch: Import Azure cloud architecture

Supported Azure environments, resources, and lines

For a comprehensive list of the supported environments, resources, and lines from Azure that are available in Lucid refer to our Supported Azure environments, resources, and lines article.

Import Azure infrastructure

You can import your Azure cloud infrastructure data using one of the two following methods:

• Trusted access: This method uses a single Enterprise Application (formerly Azure AD), which may be assigned to one (or more) Azure management groups or to one (or more) individual Azure subscriptions. Import permissions are granted via a read-only role that is assigned to this application.
• File upload: This method uses a Lucid-provided Python script in a configured Azure CLI terminal to generate a JSON file of your infrastructure data for manual upload.

Check out the following table for specifics on each method and to determine which is best for your use case.

*Resource type 1 (mapped resources): All resources listed in the Supported resource section above. Resource type 2 (unmapped resources): A broad variety of resources you can place manually in your documents or access via Cloud Inventory in the data hub.
**Automatic data source refreshes are available for users to set on a recurring schedule (daily, weekly, monthly, yearly) via the data hub. Manual refreshes are performed with a single click in the data hub.

Lucid saves trusted access credentials so you can refresh your data or start new imports without re-entering your information. This storage capability allows Lucid to perform the automatic data refreshes. Credentials can be deleted via the Azure data hub credentials tab.

If you are working with a very large environment, use the information in the Optimize cloud visualization performance in Lucidchart article to reduce the amount of data you are importing, or reduce the number of API calls Lucid makes to Azure. After each import finishes, you can start a new import.

Import via trusted access

This method provides secure, ongoing access by registering an Enterprise Application with read-only permissions. With trusted access, Lucid saves your credentials, allowing you to perform both manual and scheduled automatic data refreshes.

Step 1: Create and register an enterprise application in Azure

First, you will create and register the application within your Azure portal. This application will act as the service principal that Lucid uses to authenticate.

1. Navigate to the Lucid Home Page.
2. Click Data hub from the bottom of the navigation menu on the left-hand side of the page.
3. From the providers list in the data hub, click Azure. 
4. Select Import Azure data.
5. Select Trusted access.
   
    
6. Under credential scope, choose either "management group" or "individual subscription". If you’ve previously registered a credential, you’ll be directed to the credential selection page first.
7. Click Register a new credential at the top of this page.
8. After selecting the credential scope, select Register AD application.This will direct you to a new tab with the application registration page in Azure (if already signed into Azure). Leave the Lucid browser tab open. 
   • For environments in Azure Government, select the link directly below it instead.
     
9. On the registration page in Azure, add a name for the application and keep the default settings for all remaining fields.
10. Click Register to complete the registration of your Enterprise Application.
11. Go to App registrations in Microsoft Entra ID and select the application you just registered.
12. Under Properties, copy the “Application (client) ID” by clicking the copy-to-clipboard icon.
    • Back in your Lucid tab, paste this value in the  “Application (client) ID” field.
    • Repeat this process for the “Directory (tenant) ID”.
      
13. In your Azure tab, select Manage in the left-hand navigation menu.
14. Select Certificates & secrets. 
15. Click + New client secret.
16. Provide a description, select an expiration period, and click Add. 
17. Copy the new secret's Value immediately since this value is only displayed once. Back in your Lucid tab, paste this value in Step 3’s field “Client secret value”. 

Step 2: Assign a role to the enterprise application

After creating the application, you must grant it permissions to read your Azure environment's metadata. You have two options: assigning a built-in, read-only role (recommended) or creating a custom role with minimum required permissions. These two options are listed under Step 2: “Assign a role to the AD application”. 

Option A: Use a read-only role for all resources (Recommended)

Lucid recommends using Azure's built-in role for read-only access, as new Azure resources are automatically added and become available for Lucid imports. This approach grants the application read-only access to all resources within the specified scope (either a Management Group or a specific Subscription).

1. In the Azure portal, navigate to the Subscription or Management Group you wish to import.
2. Select Access control (IAM) from the navigation menu.
3. Click + Add.
4. Choose Add role assignment.
5. On the Role tab, search for and select the built-in Reader role.
6. Navigate to the Members tab.
7. Click + Select members and search for the name of the Enterprise Application you registered earlier.
8. Select the application.
9. Click Save.
10. Click Review + create to complete the role assignment.

Option B: Create and assign a custom role

In this approach, you create a role with the exact minimum permissions required for an import.

1. In your Lucid tab, go to step 2 and select the “Custom role” option.
2. Click Download JSON file to save the role baseline permissions file.
3. In the Azure portal, navigate to the Subscription or Management Group you want to import.
4. Go to Access control (IAM).
5. Select + Add > Add custom role.
6. Next to Baseline permission.
7. Choose Start from JSON and upload the file you downloaded from Lucid.
8. Give the role a descriptive Custom role name, such as Lucid Minimum Read Access.
9. On the Assignable scopes tab, verify that your target subscription or Management Group is listed. If not, select + Add assignable scopes. 
   • For Management group level imports, set the type to "Management Group" and select each group you’d like to import. 
   • For individual subscription level imports, set the type to "Subscription" and select each subscription you’d like to import. 
10. Click Review + create.
11. Select Create to finalize the custom role.
12. In the Access control (IAM) settings of your subscription or Management Group.
13. Click + Add.
14. Select Add role assignment.
    • For the Role, search for and select the custom role you just created.
    • For Assign access to, leave the default value (User, group, or service principal).
    • For Select, find and choose the Enterprise Application you registered.
    • Click Save to apply the role assignment.

Step 3: Add credentials and import subscriptions to data hub

Finally, you will provide the application credentials to Lucid to validate the connection.

1. Return to the Lucid tab you previously left open.
   • If your application was created in Azure Government, update the “AD Application Type” to “Azure Government application”. 
2. Enter a display name for the credential so you can identify it later. This will go in the “AD Application display name” field.
3. Click Next.
4. Check the boxes for the subscription(s) you wish to import.
5. Click Next.
   
6. Select the resource types you wish to import.
   • When importing subscriptions to the Lucid Data Hub, you have the option to omit chosen resource types or metadata from the import. This grants you the ability to visualize only resource types you’re interested in and, in some cases, can increase the speed of the import. Deselected resource types and metadata will not be imported or visualized in a diagram. 
   • For subscriptions with a large number of resources, see Optimize performance in Lucidscale to enhance your product experience.
   • For credentials with more than 1 subscription, the configuration for metadata and resource types being omitted will apply to all subscriptions listed in the “Import Summary” section.
7. (Optional) Customize the name of each Azure subscription. Additionally, you can add prefix text to all listed subscriptions.
   
8. Click Import Azure subscriptions.

File upload

To import Azure infrastructure via a JSON file upload, follow these steps:

1. On the Lucid Home Page, click Data hub in the left-hand navigation menu.
2. Select Import Azure data.
3. Choose File upload.
4. Select Global Azure Application or Azure Government Application depending on where your Azure instance resides. Leave this tab open so you can return to it later.
5. Click Download requirements.txt and Download script. 
6. Configure your Azure CLI using the requirements.txt file and the instructions listed at the beginning of the azurecliscript.py file.
   • For more configuration instructions, see Azure File Upload Script Description section below.
7. Execute the Python script in your Azure CLI. An azure.json file will be generated. 
8. In the Lucid Data Hub tab, select Choose file and upload the azure.json file. 
9. Click Next.
10. Provide an alias name for each subscription you’d like to import.
11. Select Import Azure subscriptions.

Azure File Upload script description 

The Lucid-provided import script, azurecliscript.py, leverages the Azure CLI and Azure SDK for Python to collect your Azure resource configuration. It requires proper authentication and specific subscription selection.

The script uses AzureCliCredential for authentication, relying on your active Azure CLI session established with az login. Your credentials from az login grant access to your Microsoft Entra ID (Active Directory) tenant.

• If you are retrieving data from Azure Government Cloud, first set the cloud environment: az cloud set --name AzureUSGovernment.
• Otherwise, for Global Azure, ensure the cloud environment is set to AzureCloud: az cloud set --name AzureCloud.

For detailed documentation on managing Azure subscriptions and authentication with the Azure CLI, refer to Azure's documentation on Manage Azure subscriptions with the Azure CLI and Sign in with Azure CLI.

Requirements:

• Python: Versions 3.0-3.9. Ensure "Add Python to PATH" is selected during installation.
• Azure CLI: Installed and configured.
• Azure SDK Packages: The script requires specific Azure SDK packages (e.g., azure.mgmt.compute, azure.mgmt.network, etc.). These are installed by running pip3 install -r requirements.txt after downloading requirements.txt from the data hub.

Parameters:

• -s, --subscriptions [REQUIRED] 
  • Specifies one or more Azure subscription IDs from which to import resources. This option can be repeated to import from multiple subscriptions within your authenticated Azure CLI session.
• -o, --output
  • Specifies the filename for the generated output JSON. If not specified, the default filename azure.json will be used.
• -c, --count
  • Outputs a JSON file named count.json containing a count of resources. When this flag is used, the generated JSON file is not suitable for Lucid imports.

Example:

The command above runs the script and generates a JSON file named my_azure_data.json for resources residing in the specified Azure subscriptions.

Use the data hub to manage Azure infrastructure data and credentials

Imported subscriptions

After importing Azure subscription data, it will be listed as a data source with the subscription name you specified in the "Azure: Imported Subscriptions" section of the data hub. From this section you can also click + New Subscription to import a new subscription to the data hub.

Subscriptions listed in this section are data sources that can be used to create new Lucidchart documents. Data sources (“Subscriptions”) contain the Azure subscription metadata used to create Lucidchart documents. The “Last updated” field indicates when your data source was last refreshed to account for any updates in your connected Azure subscription.

The Cloud Inventory of each subscription can be seen on the right-hand side after selecting a subscription from the list. This inventory allows you to see a full count of each type of resource that has been imported before creating a document. You can also download a CSV for credentialed imports, this file contains a list of resources and count directly from the data hub by clicking Download CSV.

The inventory lists all resources that can be accessed by the role permissions assigned to your AD application. If you elect to “Use a read-only role for all resources”, all resources in your subscription which are accessible by Azure’s “Reader” role will be rendered in the inventory. If you create a custom role, only the resource types specified in your assigned role permissions will be rendered in the inventory.

Click the three-dot menu rendered on a subscription to access the following potential options: 

• Create new document begins rendering the Azure infrastructure associated with the subscription as a diagram in a new document's workspace. A document will be generated in the background of your Lucid Home Page and we will notify you once it has been rendered through the status modal that appears in the bottom-right of the page.
• Update Subscription from Azure and Schedule update allow you to manually or automatically update the Azure subscription data you have imported to the data hub to reflect any changes in the connected Azure subscription. New documents created from the subscription after the update will reflect any changes in the connected Azure subscription. 

• Edit resources will allow you to edit the resources included in each dataset. Selecting this option will open up a modal in which you can add or remove any resources from your existing datasets. When you’ve finished with the selection, click Save and update Subscription. This will ensure that the dataset refreshes and documents referencing that dataset are updated to the latest information.
  
• Rename Subscription allows you to change the name of the selected dataset.
• Delete Subscription removes the imported subscription from the Lucid Data Hub. Any documents created from that subscription will lose the ability to update data from Azure. You can import the same Azure subscription more than once — each creates an independent data source. Deleting an existing subscription is not required before re-importing it.

Saved credentials

The Saved Credentials page in the data hub is where you can find all the AD applications you can use to import Azure subscriptions to the data hub. From this page, click + New AD application to add a new set of credentials that can be used to import an Azure Subscription.  

To share the AD applications you have created with other users, click the three-dot menu rendered on an AD application. 

From here, you have two potential options: 

• Share credential opens a modal that allows you to share an AD application you created with another user on your Lucid account by specifying their email address. Granting them access to the AD application allows them to import the associated Azure subscription(s) to the data hub and create Lucidchart documents. After a credential has been shared with another user, you can revoke their access to the credential by clicking the X next to their email address in the same modal.
• Delete credential removes your AD application from the data hub. After deleting a credential, all subscriptions previously imported with that credential, along with documents created from those subscriptions, lose the ability to update data from Azure.  

Security information

Azure AD application

Entra ID (formerly Azure AD) application is the preferred method from Azure for managing digital identities for both external and on-premises applications. 

This method allows Lucid to securely store credentials that allow you to easily import and refresh your diagram. 

See these resources for more information:

• What is application management? 
• Quickstart: Register apps with Microsoft identity platform

Secure, limited access 

Lucid requests limited, read-only access permission for the Azure AD Application you create. The permissions are defined within the custom role you tie to your application. A custom role created with these permissions cannot change settings in your Azure architecture or read data in your databases. Lucid only uses the AD Application to read the structural metadata of your Azure infrastructure. Lucid only reads from subscriptions that you grant us access to; you can control that by limiting the scope of the custom role attached to the AD application assigned to Lucid. 

CLI script alternative

To review and control the actions Lucid takes during our Azure infrastructure scan, you can download and use our provided Python script instead of creating an Azure AD application. In this scenario, your credentials will never be passed to Lucid, and you can review both the code that will run in your environment and the resulting metadata before uploading the metadata to Lucid. Your imported JSON will be accessible in the Lucid Data Hub to use for creating Lucidchart documents.

Safe storage of documents (documents)

Lucid stores Azure imported metadata and generated documents using industry standard protections for confidential data. Imported Azure data is embedded as part of the Lucidchart document, so you can control access to the data using Lucid’s standard sharing permissions. For additional information regarding how Lucid protects your documents, refer to our Content Security page or contact our sales team.

FAQ

How does Lucid get access to our Azure environment? What level of access does Lucid have?

The recommended method from Lucid and Azure is through an Azure AD Application. We provide a policy which gives us “describe and list” access to your environment so we can get an inventory of resources.

We also have a method using a python script you can run through the Command Line Interface (CLI) which generates a JSON file. Users can then upload this JSON file to Lucid and not populate any credential information into Lucid.

What APIs does Lucid access?

We primarily use describe and list API endpoints.

Can I choose which metadata (the fields and values shown in the Data panel) is imported? If not, what metadata is imported?

No, you can't currently choose what metadata is imported. However, we are looking to create some ability to do that in the future. All metadata from a describe API call is imported.

Give feedback on this article