Cloud Connections

Goal: Connect the Azure subscription your workspace builds in.

Environment -> Cloud Connections is always in the menu. It is the first step: Manage Private CALZ appears once a cloud is connected, and the rest of the Environment menu once the landing zone is provisioned.

A workspace connects one cloud today. Microsoft Azure is the only provider that connects; the Amazon Web Services and Google Cloud tiles say Coming soon and open a short "what is coming" panel, with no dates.

Before you start

Nothing else in the workspace is needed. What the window offers depends on your rights:

You hold	You see
Workspace.Infrastructure.Managed	Managed Azure Subscription
Workspace.Infrastructure.Private	Bring Your Own Cloud
Neither	Upgrade needed, and neither way to connect

Upgrade needed says: "Your current plan does not include managed or private Azure connections. Upgrade to the Pro or Sovereign plan to unlock these flows." The plans are described in Get a Workspace; you choose one in Current License.

To bring your own subscription you sign in with a Microsoft account that can reach it. If Microsoft says an administrator must approve Open Industrial in that directory, the window offers Approve access in Azure for an administrator to use.

Bring your own subscription

1. In Bring Your Own Cloud, click Sign in with Microsoft. The sign-in opens in a popup; allow popups for the workspace.
2. Choose a directory: one button per Azure directory your sign-in reaches. Change directory takes you back to the list.
3. Pick how to connect, from three tabs, and finish with that tab's button:

Tab	What it asks	Button
Select Subscription	A subscription you already have in that directory	Connect Subscription
Create Subscription	Subscription Name, whether it is a Dev/Test workload, and a Billing Scope	Create Subscription
Manual (IDs + Secret)	Name, Description, Tenant ID, Subscription ID, Application ID, Application Auth Key	Connect Subscription

The button is what connects: there is no separate Save. When it is connected the window shows Connected to Microsoft Azure with the name, subscription and tenant.

A managed subscription

Managed Azure Subscription creates a subscription that Fathym runs for you. Click Create Managed Subscription; nothing is sent until you confirm:

Create a billable Azure subscription?

This creates a real, billable Azure subscription (DevTest) for this workspace. Once it is created, it cannot be deleted for 90 days.

Yes, create the subscription starts it; Cancel backs out.

Once a cloud is connected

The Microsoft Azure tile shows the connection's state, its subscription and tenant (masked to their last four characters), and two icons: Recheck this connection now and Renew the credential or switch tenants. The window checks the connection when it opens.

State	Means
Connected	Azure accepted the stored credential
Checking	The check is running
Connection failed	Azure rejected the stored credential. Nothing new can be provisioned until it is renewed
Couldn't check	The check could not run, so the credential was not tested. This is not a failure

Renew the credential

The credential expires. As the date gets close, the window says so, and the Cloud Connections menu item shows a badge until it is renewed. Once it has expired:

This connection's credential expired on (date). Azure will reject anything this workspace tries to provision until you use Renew Connection.

OpenX does not renew it on its own; a person does. In the renew view:

Button	What it does
Renew Connection	When the app registration is OpenX's own: adds a new secret in one click, keeping the same ids
Reconnect Cloud	When the app registration is not OpenX's: you reconnect through Microsoft
Connect a different subscription instead	Goes back to choosing a directory and subscription
Back to Overview	Returns to the summary

Replace credentials, on the connected card, starts the connect steps again as if no cloud were stored.

A workspace does not move between subscriptions or directories. Once connected, a different subscription, tenant or application id is refused, and so is a billing scope. To refresh an expired credential, use Renew Connection.

Save and Deploy

This window has no Save; its own buttons do the work. Connect Subscription, Create Subscription, Renew Connection and Yes, create the subscription each build at once: the window starts a commit that runs the cloud connection's setup in Azure, and follows it in its Latest deployment panel. It does not wait for Deploy. While it runs, another setup window's save and a Deploy are refused (DEPLOY_IN_PROGRESS), and a canvas Save is refused while the commit is still queued; wait for it to finish.

A cloud connection cannot be removed from the workspace.

Rights

The two rights above decide only what the window offers; connecting itself checks no access right. Connecting your own subscription uses your own Microsoft sign-in.

Azi and agents

Azi, or an agent connected over MCP, can propose a cloud connection: its name and description, and the subscription, tenant and billing scope until the cloud is connected. It can propose either an existing subscription (a subscription and its tenant) or a new subscription to be created under a billing scope (a billing scope and no subscription). The agent never sees your real ids: it proposes codes for this workspace, and this window turns them into your own ids from your own Azure sign-in. It can never propose the secret, anything only you set at connect, anything the connection writes for itself, or any other field:

Code	When
CREDENTIAL_IN_PROPOSAL	The proposal names the connection's secret: "It is created when the person connects in the Cloud Connections window."
IDENTITY_ALREADY_STORED	The proposal changes the subscription, tenant or billing scope of a cloud that is already connected
PERSON_ONLY_FIELD	A field only you set when connecting, such as the application id
ACTUATOR_OWNED_FIELD	The connection's own id or its secret's id or expiry: "is written by the Clouds actuator when the connection is made, so it can never be proposed."
UNKNOWN_CLOUD_FIELD	Any other field: "is not a proposable Cloud field. Allowed: Name, Description, SubscriptionID, TenantID, BillingScope."

A pending proposal shows over the normal Connect form: "An agent has proposed a cloud connection for this workspace", with what it proposes. After your Azure sign-in, the form opens filled from the proposal: the proposed directory is chosen, and the proposed subscription is selected (or, for a new subscription, Create Subscription opens with the proposed billing scope). "Change anything you like: Accept proposal and Connect accepts the proposal, then connects with what the form holds. Only your connect makes the connection." In place of the standard button, each tab's button reads Accept proposal and Connect: one press accepts the proposal, then connects. A proposed id your own Azure does not hold is left for you to pick, and the form says so.

A proposal accepted anywhere else, such as the Proposals panel or the canvas, is saved as a cloud that is not connected yet. This window then opens on the same Connect form, filled from what was saved, with the standard button. When the workspace already has a working cloud, the proposal shows at the top of the window with Accept Proposal, and "accepting only records the proposed name and description." Reject Proposal rejects it: "Nothing is created in Azure, and every change in its bundle is rejected." Accepting takes the whole bundle the proposal came in.

Messages you may see

Code	Message
(sign-in)	"Your Azure session has expired. Sign in again to connect your cloud." The window returns to the sign-in step
GRAPH_CONSENT_REQUIRED	"An administrator of this directory needs to approve Open Industrial before it can connect. Approve access, then connect again."
CONNECT_TIME_ONLY_FIELD	The workspace is already connected to another subscription, tenant or application, "and that cannot be changed here." Use Renew Connection
CLOUD_CONNECT_FAILED	"The Azure cloud could not be connected. Try again; if it keeps happening, contact support."
MANAGED_SUBSCRIPTION_FAILED	"The managed subscription could not be started. Try again; if it keeps happening, contact support."
DEPLOY_IN_PROGRESS	A setup window or a Deploy is already running for the workspace. Wait for it to finish, then try again
CLOUD_CHECK_UNREACHABLE	"Could not reach the service that checks this connection, so the credentials were not tested. Try again in a moment."
CLOUD_NOT_CONFIGURED	"This cloud is not configured for the workspace."
CLOUD_TOKEN_EMPTY	"Failed to retrieve Azure access token." Renew the connection
CLOUD_VALIDATION_FAILED	Microsoft's own reason the credential was rejected. Renew the connection

Next steps

• Create the landing zone -> Manage Private CALZ
• The order things unlock in -> Environment