> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# Set Up Azure Tenants

This article explains how to set up an Azure tenant in Eon.
You need to complete this step once per Azure tenant before you can connect any source or restore subscriptions within the tenant.

## Set up an Azure tenant

You'll run a deployment command that creates the necessary infrastructure in your Azure environment, then provide the command's output values to Eon.

### Before you start

Before you set up your Azure tenant, make sure:

* You have the ID of an Azure subscription to use as the management subscription.
  Eon creates a managed identity and resource group in this subscription.

* You have the [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) installed and are signed in with the following permissions:

  * Owner on the [management subscription].

  * Ability to create and manage service principals and app registrations in Microsoft Entra ID.

[management subscription]: /data-protection/cloud-workloads/azure/azure-tenants/about-azure-tenants#management-subscription

#### Start the tenant setup wizard

In the Eon console, go to the

Azure setup page

and click **Set Up Azure Tenant**.

The Azure setup wizard opens to the **Management access** step.

#### Enter your tenant and subscription details

In the **Management access** step, enter the following:

* The ID of the tenant you want to set up.
  You can find this in the Azure portal under **Microsoft Entra ID > Overview**.

* The ID of the [management subscription] you want to use for Eon's infrastructure resources.
  You can find this in the Azure Resource Manager under **Organizations > Subscriptions**.

Eon uses these details to generate your deployment code.

#### Deploy

Choose **Terraform** or **Bash**.
Eon generates a deployment command pre-filled with any required values.

#### Bash

Copy the command Eon displays in the wizard and run it in your terminal.

The command signs you into the target tenant, retrieves the access tokens needed for deployment, downloads the Eon tenant onboarding script, and runs it.

#### Terraform

Copy the module invocation Eon displays in the wizard into a `.tf` file (for example, `main.tf`).

The generated snippet includes the `module` and `output` blocks only.
If your Terraform configuration doesn't already define the `azurerm` provider, add the following above the module block:

```hcl
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "..." # Your azurerm provider version
    }
  }
}

provider "azurerm" {
  features {}
}
```

For version constraints and additional provider options, see the [AzureRM provider documentation](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs).

> **Note**
>
> If the `azurerm` provider is already configured in a parent module or elsewhere in your Terraform configuration, skip this step.

The `azurerm` provider authenticates using your current Azure CLI session, so make sure you're signed in to the correct tenant and subscription (`az login --tenant <tenant_id>` and `az account set --subscription <management_subscription_id>`).

Apply the changes to deploy the necessary infrastructure to your Azure environment.

For a full list of the resources Eon creates, see [What Eon creates during tenant setup](/data-protection/cloud-workloads/azure/azure-tenants/about-azure-tenants#what-eon-creates-during-tenant-setup).

When the deployment finishes, it outputs the values that you'll need in the next step.

> **Warning**
>
> Don't move the managed identity to a different resource group or subscription after this step.
> Azure doesn't support moving user-assigned managed identities between resource groups, and doing so breaks Eon's ability to restore to the tenant.

#### Submit the output values to Eon

Copy the provided values from the script output and paste them in their respective fields in Eon.

Click **Connect & Continue** to submit the values and complete the setup.

Your Azure tenant is now set up and ready to connect source and restore subscription.

## See also

* [About Azure Tenants].

* [Azure: Connect Source Subscriptions].

* [Azure: Connect Restore Subscriptions].

* [Azure: Permissions Deployment Files].

[About Azure Tenants]: /data-protection/cloud-workloads/azure/azure-tenants/about-azure-tenants

[Azure: Connect Source Subscriptions]: /data-protection/cloud-workloads/azure/source-subscriptions/azure-connect-source-subscriptions

[Azure: Connect Restore Subscriptions]: /data-protection/cloud-workloads/azure/restore-subscriptions/azure-connect-restore-subscriptions

[Azure: Permissions Deployment Files]: /data-protection/cloud-workloads/azure/permissions/azure-permissions-deployment-files