Skip to content

Add Azure AKS clusters with One-Click Azure Integration#

Lens premium subscription feature. See details on Lens Pricing.

This page contains instructions for One-Click Azure Integration.

One-Click Azure Integration connects Microsoft Azure Kubernetes Service (AKS) clusters to Lens K8S IDE without installing or configuring the Azure CLI.

Prerequisites#

Before connecting to your AKS cluster, ensure that you have:

  • A Plus, Pro, or Enterprise subscription plan. For details, see Lens Pricing .
  • An Azure account with sufficient subscription and permissions for the target clusters.

Add an Azure organization#

  1. In Kubernetes Clusters AKS, click Add Azure Organization . The Add Azure Integration modal opens.

  2. Under CHOOSE YOUR AZURE SIGN-IN METHOD, select one of the two options:

    • Sign in with recommended settings: use your Azure account with default cloud and tenant detection. Choose this option for Azure Public.
    • Advanced sign-in configuration: select cloud instance and specify organization or tenant. Choose this option for sovereign clouds or service-principal access.

    Add Azure Integration modal

    Tip

    Most users can use the recommended sign-in. Choose Advanced if your organization requires a specific Azure cloud or tenant.

  3. Click Next to continue with the selected flow.

  1. Choose Sign in with recommended settings and then Sign in with Microsoft Entra SSO.

  2. A browser tab with the Microsoft Azure login page opens.

    Microsoft account picker

  3. Sign in to your Azure organization. After a successful sign-in, a tab opens where the following message is displayed:

    Auth code was successfully acquired. You can close this window now.

    Close the tab and return to Lens K8S IDE.

Advanced sign-in#

Use this flow when you need to choose the Azure cloud, target a specific tenant, or sign in with a service-principal client secret.

  1. In the Add Azure Integration modal, choose Advanced sign-in configuration and click Next.

    Advanced sign-in configuration selected

  2. Under Advanced Azure sign-in, select the Azure cloud instance:

    • Azure Public (Recommended): the standard Azure cloud used by most organizations.
    • Custom Azure cloud: for sovereign clouds (for example, Azure Government or Azure China). Enter the base Azure sign-in URL in the field that appears. The value must use HTTPS and must not include a tenant or path segment.

  3. Choose how to sign in:

    • Sign in with Microsoft Entra SSO: completes the same browser-based login as the recommended flow, scoped to your selected cloud.
    • Sign in with Client Secret: uses a service-principal credential. Fill in:
      • Tenant ID
      • Client ID
      • Client Secret

    Client Secret values are masked on entry.

Storing credentials

When connecting to Azure, your operating system may display a prompt to create or unlock a secure credential store (for example, Keyring on Linux or Keychain on macOS).

This is an expected operating system–level security mechanism. It allows the system to securely store Azure tokens or certificates in encrypted storage instead of plain text.

The prompt is generated by the operating system, not by this application or by Azure.

We recommend selecting Allow always, or a similar option, to enable secure authentication and avoid repeated sign-in prompts.

After completing these steps, the available Azure directories and subscriptions with clusters are listed in Kubernetes Clusters AKS, grouped by resource group.

An example of Azure AKS

Rename a resource group#

You can rename an Azure resource group from the Lens UI to give it a friendlier label. The rename is local to Lens and does not change the resource group in Azure.

  1. In Kubernetes Clusters AKS, locate the resource group you want to rename.
  2. Open the resource group's context menu and choose the rename option.
  3. Enter a new name and confirm.

Private AKS clusters#

Lens supports private AKS clusters. Add the organization as described above; private clusters appear in the AKS list alongside public clusters, and Lens uses the Azure-managed network path to connect.