Cloud Service Import
Import live SaaS, PaaS, and IaaS inventory — including licensing and cost — from Azure, AWS, GCP, IBM Cloud, DigitalOcean, Oracle Cloud, or a generic REST catalog into Ops Management → IT Assets.
Who this is for
Operations and architecture teams that want the IT asset catalog to reflect what is actually running in the cloud, not only CMDB exports or hand-entered rows.
How to open it
In the workspace, go to Tools → Cloud Service Import. From the IT Assets list you can also choose Cloud Import.
What is imported
Each discovered service is mapped onto the existing IT asset record. Extra cloud fields are stored in new columns; existing columns are not renamed or removed.
| Source data | IT Asset field |
|---|---|
| Resource / SKU name | Asset Name |
| SaaS, PaaS, or IaaS | Asset Type and Cloud Service Model |
| Provider | Provider and Cloud Provider |
| ARM ID, ARN, CRN, or resource name | Serial / Reference ID and Cloud Resource ID |
| Region | Deployment Environment and Cloud Region |
| SKU / plan | Cloud SKU |
| License SKU, seats, consumed | License Type, License SKU, No. of Licenses, Installed Licenses |
| Prior-month spend | Asset Cost (monthly), billing currency, cost period |
| Tags | Cloud Tags |
| Last successful pull | Last Cloud Sync |
Matching for updates uses cloud resource ID, then asset code, then name + provider.
Azure app registration
The Azure connector uses a Microsoft Entra app registration (service principal) with subscription RBAC, not only API permissions on the app.
If discovery returns *No Azure subscriptions were returned*, the client ID and secret are usually valid, but the app has not been granted a role on any subscription.
1. Create the app
- Open Azure Portal → Microsoft Entra ID → App registrations → New registration.
- Name it (for example
PlexArch Cloud Import). - Supported account types: Accounts in this organizational directory only.
- Redirect URI is not required. Register.
Copy:
| PlanIT field | Where it is in Azure |
|---|---|
| Azure Tenant ID | App registration Overview → Directory (tenant) ID |
| Azure Client ID | Overview → Application (client) ID |
| Azure Subscription ID | Optional. Subscriptions blade → Subscription ID. Leave blank to pull every subscription the app can see. |
2. Create a client secret
- App registration → Certificates & secrets → New client secret.
- Copy the Value immediately into Azure Client Secret. Azure does not show it again.
3. Grant subscription access (required)
API permissions on the app registration are not enough. Assign an Azure role to the enterprise application (same name as the app):
- Azure Portal → Subscriptions → select the subscription that holds the resources.
- Access control (IAM) → Add → Add role assignment.
- Role: Reader.
- Members: User, group, or service principal → find the app name (
PlexArch Cloud Import). - Review + assign.
For monthly cost, add a second assignment: Cost Management Reader on the same subscription (or Cost Management Contributor if Reader is not available in your tenant).
To cover several subscriptions at once, assign the same roles at a management group instead of each subscription.
Role assignments can take a minute to appear. If the list is still empty, confirm you used the tenant where the subscription lives, not a personal Microsoft account tenant.
4. Optional Microsoft 365 / Entra licenses (SaaS)
For Graph subscribedSkus (M365 license SKUs):
- App registration → API permissions → Add a permission → Microsoft Graph → Application permissions.
- Add Organization.Read.All (or Directory.Read.All).
- Grant admin consent.
Without this, IaaS/PaaS resources still import; the preview shows a Graph warning.
5. Optional Resource Graph
Resource Graph is used first for inventory. If it is denied, PlanIT falls back to the ARM resource list. No extra role is required beyond Reader.
Values to paste into Tools → Cloud Service Import
Select Microsoft Azure, keep SaaS/PaaS/IaaS as needed, paste Tenant ID, Client ID, Client Secret, optionally Subscription ID, then Discover Live Services.
Supported providers
| Provider | Live APIs used | Credentials (not stored) |
|---|---|---|
| Microsoft Azure | ARM / Resource Graph, Cost Management, Microsoft Graph subscribedSkus | Tenant ID, client ID, client secret. Optional subscription ID. |
| Amazon Web Services | Cost Explorer, Resource Groups Tagging, License Manager | Access key, secret, region. |
| Google Cloud | Cloud Asset Inventory. Optional Workspace SKUs | Project ID plus access token or service account JSON. |
| IBM Cloud | Resource Controller | IAM API key. Optional account ID. |
| DigitalOcean | Droplets, Apps, Databases, Kubernetes, Volumes | Personal access token. |
| Oracle Cloud | Compute instances, Autonomous Databases | API signing key (tenancy, user, fingerprint, PEM) and compartment OCID. |
| Other cloud / REST | Any HTTPS JSON array | Endpoint URL, optional bearer token, optional JSON array path (value, items, resources). |
Choose SaaS, PaaS, and/or IaaS before you discover. At least one model must stay selected.
How to use it
- Select a provider card.
- Enter credentials for that provider. They are used only for this call.
- Choose Discover Live Services.
- Review the preview (name, model, region, license, seats, monthly cost, create vs update).
- Choose Import N Services. Created and updated counts are shown, then View IT Assets.
If Cost Management, Graph, License Manager, or Workspace APIs are denied, inventory still imports and the page lists those APIs under Partial data.
After import
Open Ops Management → IT Assets. Filter by Cloud Provider or SaaS / PaaS / IaaS. Asset detail shows a Cloud, License & Cost section.
For on-prem or CMDB hardware, continue to use CMDB Asset Import.