Connecting sources

Part ofKeep one register of everything you own

Connect your clouds, directories and CMDB to MESH so your asset register fills and stays current by itself. This page explains how to connect each source, how to check and refresh a connection, and exactly what Soveryne can and cannot access.

Only an Admin of the MESH workspace can connect and manage sources.

What you can connect

Source	What MESH reads
Microsoft Azure	Cloud resources and access
Microsoft Entra directory	People, groups and workload identities
Amazon Web Services	Resources, IAM and Identity Center
Google Cloud	Resources, service accounts and access
Google directory	Workspace users, groups and memberships
ServiceNow	CMDB assets and relationships

Cloud resources and directories are separate connections. To import both your Azure resources and your Entra users, connect Microsoft Azure and Microsoft Entra directory one after the other. The same goes for Google Cloud and Google directory.

How it works

You sign in at the provider's own sign-in page (or, for AWS, approve a stack in your AWS console). You never type a password or key into MESH.

MESH lists the accounts the sign-in can see, for example your Azure subscriptions. You choose which to import.

MESH checks that it can read each account, then starts the first import straight away.

After that, MESH refreshes every connected source every hour.

MESH only reads. It never creates, changes or deletes anything at the source.

Before you begin

Have an administrator of the provider at hand. See What each source needs.

Allow your browser to open a new tab for MESH: the AWS connection opens one.

If a provider shows Unavailable in the connection window, with "Not available in this workspace yet. Ask your service provider to enable" and the provider's name, it has not been set up for your workspace yet. Contact Soveryne or your Soveryne partner.

Connect a source

Select Connected sources in the navigation.

Select Connect source (or Connect a source if you have no connections yet).

The Connect a source window lists the providers: "Choose a provider. Sign in to discover your accounts and verify inventory access." Select Connect on the provider you want.

Back in MESH, the window shows "Checking authorization…".

If the sign-in can see more than one account, MESH says "Choose the accounts to import." Tick the accounts and select Connect selected accounts. With only one account, MESH connects it directly.

For each account MESH shows "Verifying inventory access for" and the account's name.

When it is done, MESH shows that the account is connected: "The first sync is starting. MESH refreshes authorized inventory hourly." The source appears as a card on Connected sources.

If something goes wrong, the window shows the reason and a Retry connection button.

Microsoft Azure and Microsoft Entra directory

Select Connect on Microsoft Azure or Microsoft Entra directory.

Your browser goes to the Microsoft sign-in page. Sign in with an account in your organisation's Microsoft tenant.

Microsoft asks you to grant Soveryne access. Review the permissions and accept. For Microsoft Entra directory, an administrator who can consent for the organisation must accept.

Microsoft sends you back to MESH. Continue at step 5 of Connect a source.

For Microsoft Azure, MESH imports the subscriptions it can read. If the card later reports that no subscription is readable, assign the Reader role on your subscriptions to Soveryne's application, then select Verify connection.

Amazon Web Services

Select Connect on Amazon Web Services.

A new tab opens the AWS CloudFormation console with a prepared stack. Its name starts with SoveryneMesh-. If no tab opens, MESH says "Allow a new tab to open, then choose Connect again."

Review the stack and create it. It creates one read-only IAM role, SoveryneCensusReader, with the policy SoveryneCensusRead. Only Soveryne can use this role, and only with an external ID unique to your connection.

Leave the MESH window open. It says "Approve the inventory role in AWS. MESH will detect completion automatically." MESH notices when the stack is complete and continues by itself.

MESH finds your resources through AWS Resource Explorer. Turn on Resource Explorer with an aggregator index, so MESH can see resources in every Region. Without it, MESH sees at most one Region.

If you use AWS IAM Identity Center outside the default Region, set its Region afterwards:

On Connected sources, select Manage connection on the AWS card.

Select Identity Center region.

Enter the Region in AWS Identity Center region (for example eu-west-1) and select Save region.

MESH shows "Region saved. Refresh the source to verify directory coverage." Select Refresh now on the card.

Google Cloud and Google directory

Select Connect on Google Cloud or Google directory.

Your browser goes to the Google sign-in page. Sign in with an account in your organisation.

Google asks you to allow Soveryne access. Review and allow it.

Google sends you back to MESH. Continue at step 5 of Connect a source.

Google directory needs a Google Workspace administrator. With another account, MESH says "Google directory administrator access is required."

ServiceNow

Your ServiceNow instance address is set up for your workspace by Soveryne. Give your instance name (<name>.service-now.com) to Soveryne or your partner first.

Select Connect on ServiceNow.

Your browser goes to your ServiceNow instance's sign-in page. Sign in with an account that can read your CMDB, and allow access.

ServiceNow sends you back to MESH. Continue at step 5 of Connect a source.

Check the state of your sources

Connected sources shows one card per connection. The summary at the top says how many connections are shown and whether "All connections verified" or how many need attention. Use Search connections… to find one by account name or provider.

The Connected sources page with a card for each connection, its health and its last and next sync

Each card shows the provider, the account name and a health label:

Label	Meaning
Connected	Verified and importing every hour.
Syncing	An import is running now.
Needs verification	MESH has not verified this connection yet, so it does not import. Select Verify connection.
Needs attention	Something went wrong, for example access was withdrawn. The card says what.

The card also shows Last successful sync and Next sync. Open Inventory coverage to see what MESH can read from this source, for example Assets, People and groups, Workload identities or Resource access. Each item says whether it is Available, Stale, Incomplete or Not supported, how many active records it holds and, if something is missing, why.

Verify, refresh and reconnect

Each card has one main button, which depends on its state:

Verify connection: checks that MESH can read the source. A verified connection starts importing straight away and then every hour.

Refresh now: starts an import now instead of waiting for the next hourly one. MESH says "Refresh requested. Inventory updates after the run completes."

Select Manage connection to open the connection's details: its sync times, scope, coverage and when it was last verified. There you also find:

Reconnect: sign in again, for example after the provider's access expired. Sign in with the same account; MESH refuses a different one ("Reconnect the same account, or connect this account as a new source."). Only the admin who connected the source can reconnect it.

Verify grant: checks the access again.

Import now: starts an import, the same as Refresh now on the card. It is available only for a verified connection.

Identity Center region: for AWS only, see above.

Remove source: see the next section.

While an import is running, MESH does not let you change the source. Wait for it to finish.

Remove a source

On the source's card, select Manage connection.

Select Remove source.

Read "What happens next": "Synchronization stops and the connection is removed from MESH. Collected inventory stays available as stale data."

To delete the inventory as well, tick Also remove collected inventory. This deletes the source's inventory and asset observations; your own fields and the history stay. MESH warns: "Inventory cleanup cannot be undone."

Select Remove source.

The source disappears from the list. Soveryne's access through this connection is withdrawn, unless another of your connections uses the same sign-in.

What Soveryne can and cannot access

Soveryne can:

read the inventory each source offers, as listed in What you can connect;

for Microsoft Entra directory: read users, group memberships, applications and directory roles;

for Google directory: read your organisation's users, groups and group members, read-only;

for AWS: use the read-only SoveryneCensusReader role you created, and only with its external ID.

Soveryne cannot:

create, change or delete anything in your clouds, directories or CMDB. MESH only reads;

see your passwords or keys. You sign in at the provider's own page; MESH accepts only the genuine provider sign-in addresses, and no source credentials reach your browser;

go on reading a source after you withdraw its access at the provider.

To withdraw access at any time:

remove the source in MESH, see Remove a source; and

at the provider: remove Soveryne's application from your Microsoft or Google tenant, delete the SoveryneMesh- stack in AWS CloudFormation, or revoke the access in ServiceNow.

What each source needs

Source	What you need
Microsoft Azure	An account in your Microsoft tenant that can consent to Soveryne's application, and the Reader role for Soveryne's application on the subscriptions to import.
Microsoft Entra directory	An administrator who can consent for your organisation.
Amazon Web Services	Permission to create a CloudFormation stack with an IAM role, and Resource Explorer turned on with an aggregator index.
Google Cloud	An account in your organisation with read access to the projects to import.
Google directory	A Google Workspace administrator.
ServiceNow	Your instance name, given to Soveryne beforehand, and an account that can read the CMDB.

Troubleshooting

Message	What it means	What to do
Unavailable on a provider, with "Not available in this workspace yet. Ask your service provider to enable" and the provider's name	This provider is not set up for your workspace.	Contact Soveryne or your Soveryne partner.
"Authorization was cancelled. You can connect again."	You cancelled at the provider's sign-in page.	Select Connect again.
"Authorization expired or was already used. Connect again."	The sign-in took too long, or was used already.	Select Connect again.
"No inventory accounts are accessible with this login."	The account you signed in with cannot see any subscription, project or account.	Sign in with an account that has access.
"The previously connected account is not accessible with this login. Sign in with an account that has access."	When reconnecting, you signed in with an account that cannot see the connected account.	Reconnect with the right account.
"This authorization belongs to another administrator."	Another admin connected this source.	Ask that admin to reconnect it.
"Provider access expired or was revoked. Reconnect this source."	The provider no longer accepts Soveryne's access.	Select Manage connection › Reconnect.
"Verify this source before starting an import."	The connection is not verified.	Select Verify connection.
"Wait for the current import to finish before changing this source."	An import is running.	Wait until the card no longer shows Syncing.
"Allow a new tab to open, then choose Connect again."	Your browser blocked the AWS tab.	Allow pop-ups for MESH and select Connect again.
"Google directory administrator access is required."	The Google account is not a Workspace administrator.	Sign in as a Google Workspace administrator.
"Connections could not be loaded"	MESH could not fetch your connections. Your connections and inventory are kept.	Select Try again.

← PreviousMESH Next →Review queue and import history