HivemindOS manual

Microsoft Azure

Connect Microsoft Azure so agents can see your Azure subscriptions and resources. Start read-only and turn on management only when a task needs it. Connecting never creates an Azure subscription or deploys anything.

Open the Microsoft Azure card in Integrations. It offers two separate options.

Option 1: Hosted read-only connection

Choose Connect with Microsoft Azure.
With a work or school account, sign in.
With a personal account (Outlook, Hotmail, Skype, or Xbox), first expand Personal Microsoft account and enter the Entra tenant ID that owns your Azure subscription. Microsoft requires this for personal accounts.

Agents can then list your subscriptions, resource groups, and resources, and read one resource’s configuration from its resource ID and API version. This option cannot create, change, start, stop, or delete anything.

HivemindOS runs and pays for the sign-in service; the connection adds no Azure charge. Your organization may require an administrator to approve the HivemindOS app before sign-in works. The sign-in token is stored in your shared hive environment so your other machines can use it.

Option 2: Local Azure MCP

Choose Install read-only MCP to install Microsoft’s official Azure MCP on this machine only. HivemindOS pins and verifies the package and adds it to your installed agent runtimes. It uses about 114 MB of disk.

It starts read-only, with telemetry off and a small set of grouped tools. It signs in with your own Azure identity: if you are signed in with Azure CLI, Azure PowerShell, Azure Developer CLI, or the browser, it just works. Nothing is created in Azure during installation.

Turn on management mode

Management mode lets an agent with enough Azure permissions create, change, start, stop, or delete resources. It is off until you turn it on, and HivemindOS warns you before it does.

A normal pay-as-you-go Azure subscription has no hard spending cap. Budgets and alerts warn you but do not stop charges, and credits stop covering costs once they run out. Before you turn it on:

give the signed-in identity the narrowest role and scope that can do the job;
use a separate subscription or resource group for agent work;
set a small budget with several alert thresholds;
review existing resources, reservations, support plans, and marketplace products;
switch back to read-only when the task is done.

Remove access

Disconnect removes the hosted sign-in from your shared hive environment.
Remove in the local MCP section uninstalls the Azure MCP and removes only its own entries from your runtime settings.

Self-hosted builds

If you build HivemindOS yourself, you can use your own Entra app and sign-in service by setting AZURE_OAUTH_CLIENT_ID and AZURE_OAUTH_BROKER_URL. Keep the client secret only in your sign-in service, never in the app, repository, shared environment, or MCP settings.

Microsoft references: