Skip to main content
Version: 2.7

Add Azure cloud account

To add an Azure cloud account in Portworx Backup you need to fetch the following parameters:

  • Cloud account name
  • Storage account name
  • Storage account key
  • Subscription ID
  • Client ID
  • Client Secret
  • Tenant ID

Refer to the steps below for guidance on obtaining these parameters:

Cloud account name

  • Choose a cloud account name of your preference.

Storage account name

  • Check the Azure portal.

Storage account key

  • Run the following command:

    az storage account list |grep <storage_account_name>
    az storage account keys list --resource-group <resource_group_name> --account-name <storage_account_name>


    az storage account keys list --resource-group "resource_group_name"--account-name "storage_account_name"
    "creationTime": null,
    "keyName": "key1",
    "permissions": "FULL",
    "value": "azure-storage-account-key1"
    "creationTime": null,
    "keyName": "key2",
    "permissions": "FULL",

You can pick any one of the key values as the storage account key from this output. Alternatively, you can also get the account key details from the Azure cloud portal.

Subscription ID

  • To obtain your subscription ID, run the following command:

    az account subscription list

Client ID, Client secret and Tenant ID

To fetch these three values, you must first create a custom role, fetch AKS infrastructure resource group name, and then create a service principal.

  1. To create a custom role for Portworx Backup, copy the following content to a JSON file and save it to your root directory. Specify your own name for <custom_role_name> and enter your subscription ID.
"Name": "<custom_role_name>",
"Description": "",
"AssignableScopes": [
"Permissions": [
"Actions": [
"NotActions": [],
"DataActions": [],
"NotDataActions": []
  1. Create the role by invoking the JSON file:
az role definition create --role-definition px-backup-roles.json


"assignableScopes": [
"description": "",
"id": "/subscriptions/<subscription-id>/providers/Microsoft.Authorization/roleDefinitions/<role_definition>",
"name": "<role_definition>",
"permissions": [
"actions": [],
"dataActions": [],
"notActions": [],
"notDataActions": []
"roleName": "<custom_role_name>",
"roleType": "CustomRole",
"type": "Microsoft.Authorization/roleDefinitions"
  1. Fetch your AKS Infrastructure Resource Group name:
az aks show -n <aks_cluster_name> -g <resource_group_name> | jq -r '.nodeResourceGroup'
  1. Create a service principal for your Portworx Backup custom role:
az ad sp create-for-rbac --role=<custom_role_name> --scopes="/subscriptions/<subscription_ID>/resourceGroups/<aks_infrastructure_resource_group_name>"


"appId": "client_ID",
"displayName": "px-backup-rbac",
"password": "client_secret",
"tenant": "tenant_ID"

App ID is the Client ID, password is the Client Secret and tenant is the Tenant ID values.

Alternatively you can use the below command to generate Tenant ID alone:

az account tenant list

Subscription ID can be obtained from the 4th row of this table.

You can now add an Azure cloud account in Portworx Backup with the inputs obtained from the above steps.

Add Azure cloud account

Once you have all the parameters from the above steps, you can now add Azure cloud account in Portworx Backup.

  1. In the home page, from the left navigation pane, click Clusters.

  2. At the upper-right corner, click Settings > Cloud Settings:

  3. Under Cloud Accounts, clickAdd:

  4. Choose Azure from the dropdown list:

    Select Azure

  5. Populate the following fields:

    • Cloud Account Name: enter a descriptive account name

    • Storage account name: specify the name of your Azure account

    • Storage account key: specify your Azure account key

    • Client Id: specify your Azure application client ID

    • Client Secret: specify your Azure application client secret

    • Tenant Id: specify your Azure Active Directory tenant ID

    • Subscription Id: specify your Azure subscription ID

    Populate the fields

  6. Click Add.

Was this page helpful?