Three steps. Nothing to install.

1. Sign in with your Microsoft work account

No Kronikl password is created, because there is no Kronikl password — sign-in is Entra SSO against your existing corporate account. The first sign-in creates your organization from the tenant you signed in from.

2. Grant admin consent

Kronikl asks Microsoft for four read permissions, and the screen before you leave lists them in plain language so you know what you are approving before you see the raw permission names. This step needs a Global Administrator or Privileged Role Administrator.

Consent alone gives Kronikl no access to your resources at all — it grants directory permissions, which is a different thing from Azure RBAC. That is why there is a third step.

3. Assign the role, yourself

Kronikl generates the command and never runs it. You get it as Azure CLI, PowerShell, Terraform or Bicep, and your administrator runs it. A governance product that could elevate its own permissions inside your tenant would not survive its first security review, so it cannot.

The default is Azure's built-in Reader role. If you would rather Kronikl could not even enumerate Key Vault secret names, there is a custom role for that — it needs roleDefinitions/write, which not every administrator holds.

Assign it at the highest scope you actually control. A management group covers subscriptions created later; a single subscription does not.

What you will need

• A Microsoft work account in the tenant you want to record.
• Someone who can grant admin consent — Global Administrator or Privileged Role Administrator.
• Someone who can assign a role at the scope you choose — Owner or User Access Administrator. Often the same person, not always.

Nothing else. No subscription to deploy into, no Marketplace offer to accept, no VM, no agent, no script running on a schedule inside your environment.

You can stop halfway

Step 3 is the one that usually needs somebody else. Kronikl remembers where you got to, so you can sign in, get as far as consent, and hand the last step to whoever holds the rights — the walkthrough resumes where your tenant actually is, not where you left the page.

Not the person with those rights?

That is the normal case, and it is worth knowing before you start rather than three screens in. Email hello@kronikl.io and we will send back the permissions to line up and the steps in order, in one message you can forward to your Azure administrator.

When can I actually do this?

Kronikl opens to its first tenants shortly. Email hello@kronikl.io and we will connect your tenant with you when it does — the steps above are what it will take, and they are not going to change.