Skip to main content
Read-only (the Reader role). Xerg lists resources across the subscriptions the app can see with one Resource Graph query, and 30-day cost if allowed. It can’t change anything. Only admins and owners can connect services. See Connecting a service for where to find Connect, refreshing and disconnecting.

​
What Xerg lists

  • App Service and Function apps
  • Container Apps
  • Static Web Apps
  • AKS clusters
  • Virtual machines
  • Azure SQL databases
  • PostgreSQL servers
  • MySQL servers
  • Cosmos DB accounts
  • Azure Cache for Redis instances
  • Storage accounts
  • Service Bus namespaces
  • Event Hubs namespaces
  • Azure AI / OpenAI accounts
  • Container registries
  • Key Vaults
  • DNS zones
  • CDN / Front Door profiles

​
Connect with a key

  1. Open Azure Cloud Shell
  2. Run: az ad sp create-for-rbac --name xerg-readonly --role Reader --scopes /subscriptions/<subscription-id>
  3. Optional, to see spend: az role assignment create --assignee <appId> --role "Cost Management Reader" --scope /subscriptions/<subscription-id>
  4. Paste tenant, appId and password from the output into Xerg.
Xerg asks for: Tenant ID; App (client) ID; Client secret.

​
Or sign in with Azure

Where Xerg offers Sign in with Azure, you can connect in one click instead of making a key. The sign-in only tells Xerg which Azure account is yours (it asks for openid and profile). Xerg’s own app reads it, so give that app the Reader role on the subscriptions you want mapped.