Deploy on Azure

This grants continuous.engineering access to your Azure subscription. You run one script, once. It invites our engineers into your tenant as guests and assigns each of them exactly the role their work requires: nothing shared, nothing standing beyond what's needed.

Run this in the subscription you want to grant access to:

az login
curl -fsSL https://grant-access.continuous.engineering/azure-deploy.sh -o azure-deploy.sh
chmod +x azure-deploy.sh
./azure-deploy.sh --subscription <your-subscription-id>

That's it: no account ID or output to share back with us. Sign in as an Owner or User Access Administrator on the subscription first (az login).

---

How it works

Every continuous.engineering engineer authenticates with exactly one credential: a dedicated account in our own Entra ID tenant, protected by MFA the same way our AWS and GCP access already is. Your subscription never sees a password, a shared credential, or a service account: it invites each engineer as a guest, the same mechanism you'd use to grant any external collaborator access, and Azure itself handles the sign-in redirect back to our tenant.

You don't create or manage any of these guest accounts by hand; the script reads a small, public roster (name, email, and access tier, nothing sensitive) that we maintain, and does the invite-and-assign for every engineer in one pass. Run it again any time our roster changes; it's safe to re-run: existing guests and role assignments are reused, not duplicated.

What gets created

Role	What it's for	Azure roles granted
CE-ReadOnly	Read-only, all services	Reader
CE-Security	Read-only + security findings	Security Reader
CE-Billing	Billing/cost visibility	Cost Management Reader
CE-SRE	Read + restart/redeploy + remote shell	Reader + a scoped custom role for restart/redeploy
CE-DevOps	Infrastructure build/modify	Contributor
CE-Data	Read databases/storage/analytics	Storage Blob Data Reader
CE-Admin	Full administrative access	Owner

See the full role reference (or the Azure-specific breakdown) for what each tier is meant for and how it compares across AWS, GCP, and Azure.

Revoking access

./azure-deploy.sh --subscription <your-subscription-id> --remove

This removes every role assignment the script granted. Guest accounts themselves are left in your tenant with no roles attached (harmless); delete them in Entra ID if you want them gone entirely.

Good to know before you run it

• Access doesn't have per-session tiers on Azure the way AWS sessions do. Whichever tier an engineer is assigned is active for the life of the grant, not chosen fresh each time they connect. We keep this tight by keeping our own engineer roster small and reviewed; see the role reference (or the Azure-specific breakdown) for how this compares across clouds.
• CE-Admin here is true Owner, full parity with AWS AdministratorAccess and GCP roles/owner.
• Production-tag denial (CE-DenyProd on AWS/GCP) isn't available on Azure yet. If you need production carved out from access entirely, talk to your engagement manager about scoping the invitation to specific resource groups instead.
• This is newer than our AWS and GCP paths and hasn't yet been run against a live client subscription. If anything looks off when you run it, contact us before proceeding rather than troubleshooting alone.

---

Questions: devops@continuous.engineering