Sign in first. Connect after.

Signing in creates your account and shows you the walkthrough. Connecting your Azure environment is the next step, and it is approved inside your own tenant.

Your Microsoft work account · No Kronikl password · Nothing to install

What happens after you press it

Three screens, in this order.

Microsoft asks who you are

Your Microsoft work account, on Microsoft's own sign-in page. There is no Kronikl password to choose, and the first sign-in creates your Kronikl organization.

Your administrator approves the read permissions

The five below, on Microsoft's own consent screen. This is the step that needs a Global Administrator or Privileged Role Administrator.

You assign the Azure role, with your own credentials

Create the assignment in one click while signed in as yourself, or copy the command and run it wherever you prefer. Until then, Kronikl can read your directory and none of your resources.

What Kronikl will ask for

A Global Administrator or Privileged Role Administrator approves these on Microsoft’s own screen, in exactly these words and with no reasons attached. Here are the reasons.

Permission	Why we ask
Read directory data	Turns an account ID into a person.
Read all directory RBAC settings	Shows who holds admin roles.
Read all audit log data	Shows why someone activated a role, not just who.
Sign in and read user profile	Your name and email, so you can sign in.
Access Azure Resource Manager as organization users	Lists what you can already see, and creates the Reader role there under your own account if you press the button.

Kronikl's own access is your directory only — resources are step 2.
Revoke any time: Entra ID > Enterprise applications > Kronikl > Delete.

Not the administrator?

Sign in anyway. You can still get as far as the consent screen — Kronikl remembers where your tenant actually got to — and it gives you the exact command to send to whoever administers your Azure environment.