An Entra ID app registration with a custom read-only role turns each Azure virtual machine into an ordinary SmartTile device — power state, Azure Monitor metrics, uptime history, Cost Management spend and Defender for Cloud findings — alerting and ticketing in the IT Service Management (ITSM) system your team already uses.
Azure VMs usually live in the portal, not on the NOC's screen. SmartTile CloudAutomate signs in as a service principal holding a custom role that can only read, and makes each VM a device: the power state Azure reports on this poll decides UP or DOWN. BETA: the Azure connector is code-complete and tested against the Azure SDKs; it has not yet been run against a live customer subscription, so the first connection is proven together with you in Save & Test.
Every VM in the subscription (or the regions you list) imported one-to-one under an "Azure eastus"-style location, with size, OS image, resource group, private and public IP. Re-import updates in place.
Power state from the VM instance view every 60 s: running is UP; deallocated, stopped or any error-level status is DOWN after two polls. Every change lands in state history.
Percentage CPU, network in/out, disk read/write operations, CPU credits remaining and available memory, every 5 min — feeding Device Health thresholds and the Uptime and Bandwidth charts.
Cost Management actual cost by day, by service and by location for the subscription, cached hourly on the Spend tab.
Active Defender alerts, plus unhealthy high- and medium-severity security assessments (recommendations), hourly on the Security tab.
If Azure stops answering for the app, its VMs turn UNKNOWN after ~6 minutes and the NOC gets one e-mail. A VM's creation time is never shown as uptime.
SmartTile CloudAutomate. Copy the Application (client) ID and Directory (tenant) ID.SmartTile CloudAutomate Reader (a flat CLI version is offered too).| Scope | Role actions added |
|---|---|
| Monitoring | virtualMachines/read, instanceView/read, NIC + public IP read, Insights/Metrics/Read, subscription + locations read |
| Spend | CostManagement/query/action, usage details read |
| Security | Security/alerts/read, Security/assessments/read, NSG read |
| Support | supportTickets/read + write — the only write, and only if ticked |
login.microsoftonline.com tokenClient-credential token for management.azure.comCompute virtualMachines.listAllDiscovery of every VM in the subscriptionvirtualMachines.instanceViewEvery poll: PowerState + status levelsnetworkInterfaces / publicIPAddressesPrivate and public IP of each VMsubscriptions.listLocationsRegions available to the subscriptionInsights metrics.listCPU, network, disk ops, memory, credits (PT5M)CostManagement query.usageHourly actual cost by day, service, locationSecurity alerts.list / assessments.listHourly Defender alerts and recommendationsMicrosoft.Support/supportTicketsProbe: is a support plan with API access presentMicrosoft.Support/supportTickets/{name}Only when a case is opened — off by defaultDevice: app-02 · Standard_B2s · Location "Azure eastus" · resource group rg-apps
Seen by SmartTile: instance view PowerState deallocated on two polls → DOWN
Then: the company's normal ticket path — Rev.io or the connected ITSM system — with the outage on the Uptime chart and in state history
SmartTile generates the role definition from the scopes you tick, in both the portal JSON and the Azure CLI shape. Without Support it contains only read actions.
The client secret is encrypted at rest when saved and never returned by the API. Tenant, client and subscription IDs are checked as GUIDs before saving.
Each company connects its own subscription; every CloudAutomate call is fenced to the caller's organization, and adding or testing an app needs an admin.
Region, name and tag filters apply before discovery; the import table shows exactly what will be created or updated.
Engine, status sync, health metrics, spend, security and support cases each have their own Engine Safety switch, plus a global kill switch.
App created, tested, updated or deleted and every import are written to the activity log; every sync to the Connections tab log.
| Question | Answer |
|---|---|
| Can SmartTile change our subscription? | No — the generated role is read-only unless you tick Support, which adds only support-ticket read/write. |
| Several subscriptions? | One connection per subscription. Add each as its own connection; they all land on the same dashboard. |
| Why BETA? | Every call is built and unit-tested, but no customer subscription has been connected yet. Save & Test shows exactly which scopes work on yours before anything imports. |