kronikl
Sign in first. Connect after.
Nothing is installed in your tenant. Two of the three steps happen on Microsoft’s own screens.
Signing in creates your organization under the Terms of Service and Privacy Policy.
Three steps
Sign in with your Microsoft work account
There is no Kronikl password to create. The first sign-in creates your organization.
Approve the read permissions
Five, listed below, on Microsoft’s own consent screen. This step needs a Global Administrator or Privileged Role Administrator.
Give Kronikl Azure’s Reader role
Pick the subscriptions or management groups, then grant it in one click with your own Azure sign-in, or with a command you run yourself. Recording starts once Kronikl confirms the access with a read.
What Kronikl will ask for
A Global Administrator or Privileged Role Administrator approves these; no other admin role can. On a different account? Send this page there.
| Permission | Why we ask |
|---|---|
| Read directory data | Turns an account ID into a person. |
| Read all directory RBAC settings | Shows who holds admin roles. |
| Read all audit log data | Shows why someone activated a role, not just who. |
| Sign in and read user profile | Your name and email, so you can sign in. |
| Access Azure Resource Manager as organization users | Lists the scopes you can see. Makes the Reader grant as you, if you press the button. |
- Revoke any time: Entra ID > Enterprise applications > Kronikl > Delete.
Not the administrator?
Sign in anyway. Kronikl remembers how far your tenant got. Add the person who holds the rights to your team, and they finish that step from the same screen.
Step 2 needs a Global Administrator or Privileged Role Administrator. Step 3 needs Owner or User Access Administrator at the scope, which a Global Administrator does not automatically hold.