---
title: "Azure Service Principal with Fortanix Confidential Computing Manager"
slug: "azure-service-principal-with-fortanix-confidential-computing-manager-1"
updated: 2026-06-26T16:27:53Z
published: 2026-06-26T16:27:53Z
canonical: "support.fortanix.com/azure-service-principal-with-fortanix-confidential-computing-manager-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Service Principal with Fortanix Confidential Computing Manager

## 1.0 Introduction

The purpose of this article is to describe how to set up an Azure Service Principal cluster as worker nodes in Fortanix Confidential Computing Manager (CCM).

### 1.1 Prerequisites

Ensure that you meet the following requirements:

- You need to have an active Azure subscription.
- You must have the latest Azure CLI.

## 2.0 Creating the Azure Service Principal Cluster

Perform the following steps to create the Azure Service Principal:

1. Run the following command to create an application:

```bash
az ad app create --display-name myApp
```
2. Run the following command to create a Service Principal:

```bash
az ad sp create --id <APP_ID>
```
3. Run the following command to create a resource group:

```bash
az group create -n myResourceGroup -l eastus
```
4. Run the following commands to create the custom role for managing the deployments in the Fortanix CCM:

```bash
az role definition create --role-definition '{
            "Name": "Manage deployment",
            "Description": "All permissions needed to run CCM managed deployments",
            "Actions": [
                "Microsoft.Resources/deployments/validate/action",
                "Microsoft.Resources/deployments/cancel/action",
                "Microsoft.Resources/deployments/write",
                "Microsoft.Resources/deployments/read",
                "Microsoft.Resources/deployments/operationStatuses/read",
                "Microsoft.ContainerInstance/containerGroups/delete",
                "Microsoft.ContainerInstance/containerGroups/write",
                "Microsoft.ContainerInstance/containerGroups/read",
                "Microsoft.ContainerInstance/containerGroups/stop/action",
                "Microsoft.ContainerInstance/containerGroups/containers/logs/read",
            ],
            "DataActions": [],
            "NotDataActions": [],
            "AssignableScopes": ["/subscriptions/"]
        }'
```
5. Run the following command to assign the role to the application:

```bash
az role assignment create --role "Manage deployment" --assignee <APP_ID> --scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>
```

Where,

Wait for a few minutes for the role assignment to be completed.
  - `&lt;APP_ID&gt;` refer to the Application ID of the target application.
  - `&lt;SUBSCRIPTION_ID&gt;` refers to the subscription ID for the Azure subscription.
  - `&lt;RESOURCE_GROUP&gt;` refers to the resource group where the application is deployed.
6. Run the following command to reset the credentials of the application:

```bash
az ad sp credential reset --id <APP_ID>
```

## Related

- [Compute Nodes](/ccm-compute-nodes.md)
- [Azure Kubernetes Service with Fortanix Confidential Computing Manager](/azure-kubernetes-service-with-fortanix-ccm.md)
- [Azure Connection Scanning Configuration Using Custom Roles](/fortanix-key-insight-azure-configuration-for-scanning-using-custom-roles.md)