Skip to main content

​
Azure Cost Permissions

Cloudgeni uses the service principal on your Azure integration for live Azure reads. Azure resource access, billing access, commitment access, and export file access use different permission scopes. Grant only the rows needed for the cost analysis you want. Subscription Reader inventories resources but does not provide all cost data. Quick Connect grants the subscription roles used by Cloudgeni’s standard scans, including Cost Management Reader. It does not grant MCA billing profile, tenant benefit, or blob data roles. Manual integrations need the subscription roles listed in Azure Setup first.

​
Grant MCA billing profile access

For an MCA account, an account or billing profile administrator can open Cost Management + Billing → Billing profiles → your profile → Access control (IAM) in the Azure portal. Add the integration’s Enterprise application as a Reader on each relevant billing profile. Use the service principal’s object ID in Enterprise applications when checking the assignment; its application (client) ID is a different identifier. This is a billing role assignment, separate from subscription IAM. Microsoft documents billing profile roles and service principal access to Cost Management APIs. If your agreement is an Enterprise Agreement rather than an MCA, ask your billing administrator for the corresponding EnrollmentReader access. The MCA billing profile role does not apply to that agreement type; see Microsoft’s EA service principal guidance.

​
Grant reservation and savings plan access

Reservations and savings plans have their own Azure RBAC scopes. A subscription role does not carry over to orders after purchase. Ask an administrator who can delegate access to assign Reservations Reader at /providers/Microsoft.Capacity and Savings plan reader at /providers/Microsoft.BillingBenefits if the integration needs a complete tenant-wide order inventory. If you only need specific orders, grant the corresponding reader role at those order scopes. Microsoft documents reservation access and savings plan access. An MCA billing profile Reader can view benefits paid for by that profile. The separate order reader roles are useful when an analysis must enumerate orders across billing profiles or use the tenant-wide order APIs. Granting an order role does not itself grant billing profile access for billing-scoped utilization or charges.

​
Read existing exports

An existing Cost Management export configuration can be listed through the Azure Exports List API at the subscription or authorized billing-profile scope. A successful list shows the export definition and destination; it does not grant access to the exported cost files. If you want Cloudgeni to read those files, also assign Storage Blob Data Reader on the destination container or storage account. This data role is separate from the subscription storage management roles. See Azure Blob data access. Exports and orders do not automatically provide every input for a detailed optimization plan. Confirm that available files or APIs include the required periods, actual and amortized costs, benefit utilization, renewal settings, and any negotiated prices you expect to analyze.

​
Verify access

  1. Confirm the integration’s tenant, subscription, application (client) ID, and Enterprise application object ID. Assign roles to that same Enterprise application.
  2. Check each role at its own scope: subscription IAM, MCA billing profile Access control, reservation/savings plan order RBAC, and storage container IAM where applicable.
  3. Refresh the integration’s token after role changes and retry the same read at the same scope. Azure RBAC changes can take several minutes to propagate. See Azure RBAC troubleshooting.
  4. Record the HTTP status and Azure request ID. A subscription read returning 200 only verifies subscription access; a billing profile 403 or benefit 401/403 still needs its own role check. A failure in an agent tool catalog before an Azure request requires Cloudgeni support, not another Azure role.