> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudgeni.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Cost Permissions

> Grant read access for Azure costs, reservations, savings plans, and existing cost exports.

# Azure Cost Permissions

Cloudgeni uses the **service principal on your Azure integration** for live Azure reads. Azure resource access, billing access, commitment access, and export file access use different permission scopes. Grant only the rows needed for the cost analysis you want.

| What you want to read                                                                        | Permission for the connected service principal | Scope                                                                       |
| -------------------------------------------------------------------------------------------- | ---------------------------------------------- | --------------------------------------------------------------------------- |
| Subscription actual costs and existing export configurations                                 | `Cost Management Reader`                       | Each connected subscription                                                 |
| Microsoft Customer Agreement (MCA) billing profile, its charges, and benefits paid for by it | Billing profile **Reader** billing role        | Each relevant billing profile                                               |
| Reservation orders across the tenant                                                         | `Reservations Reader` Azure RBAC role          | `/providers/Microsoft.Capacity`, or the relevant reservation orders         |
| Savings plan orders across the tenant                                                        | `Savings plan reader` Azure RBAC role          | `/providers/Microsoft.BillingBenefits`, or the relevant savings plan orders |
| Files produced by an existing export                                                         | `Storage Blob Data Reader`                     | The export's destination container, or its storage account                  |

Subscription `Reader` inventories resources but does not provide all cost data. Quick Connect grants the subscription roles used by Cloudgeni's standard scans, including `Cost Management Reader`. It does **not** grant MCA billing profile, tenant benefit, or blob data roles. Manual integrations need the subscription roles listed in [Azure Setup](/setup/azure-defender-setup) first.

## Grant MCA billing profile access

For an MCA account, an account or billing profile administrator can open **Cost Management + Billing → Billing profiles → your profile → Access control (IAM)** in the Azure portal. Add the integration's **Enterprise application** as a **Reader** on each relevant billing profile. Use the service principal's object ID in Enterprise applications when checking the assignment; its application (client) ID is a different identifier. This is a billing role assignment, separate from subscription IAM. Microsoft documents [billing profile roles](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/understand-mca-roles) and [service principal access to Cost Management APIs](https://learn.microsoft.com/en-us/azure/cost-management-billing/automate/cost-management-api-permissions).

If your agreement is an Enterprise Agreement rather than an MCA, ask your billing administrator for the corresponding **EnrollmentReader** access. The MCA billing profile role does not apply to that agreement type; see [Microsoft's EA service principal guidance](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/assign-roles-azure-service-principals).

## Grant reservation and savings plan access

Reservations and savings plans have their own Azure RBAC scopes. A subscription role does not carry over to orders after purchase. Ask an administrator who can delegate access to assign **Reservations Reader** at `/providers/Microsoft.Capacity` and **Savings plan reader** at `/providers/Microsoft.BillingBenefits` if the integration needs a complete tenant-wide order inventory. If you only need specific orders, grant the corresponding reader role at those order scopes. Microsoft documents [reservation access](https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/view-reservations) and [savings plan access](https://learn.microsoft.com/en-us/azure/cost-management-billing/savings-plan/permission-view-manage).

An MCA billing profile Reader can view benefits paid for by that profile. The separate order reader roles are useful when an analysis must enumerate orders across billing profiles or use the tenant-wide order APIs. Granting an order role does not itself grant billing profile access for billing-scoped utilization or charges.

## Read existing exports

An existing Cost Management export configuration can be listed through the [Azure Exports List API](https://learn.microsoft.com/en-us/rest/api/cost-management/exports/list?view=rest-cost-management-2025-03-01) at the subscription or authorized billing-profile scope. A successful list shows the export definition and destination; it does not grant access to the exported cost files. If you want Cloudgeni to read those files, also assign `Storage Blob Data Reader` on the destination container or storage account. This data role is separate from the subscription storage management roles. See [Azure Blob data access](https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access).

Exports and orders do not automatically provide every input for a detailed optimization plan. Confirm that available files or APIs include the required periods, actual and amortized costs, benefit utilization, renewal settings, and any negotiated prices you expect to analyze.

## Verify access

1. Confirm the integration's tenant, subscription, application (client) ID, and Enterprise application object ID. Assign roles to that same Enterprise application.
2. Check each role at its own scope: subscription IAM, MCA billing profile Access control, reservation/savings plan order RBAC, and storage container IAM where applicable.
3. Refresh the integration's token after role changes and retry the **same** read at the **same** scope. Azure RBAC changes can take several minutes to propagate. See [Azure RBAC troubleshooting](https://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshooting).
4. Record the HTTP status and Azure request ID. A subscription read returning `200` only verifies subscription access; a billing profile `403` or benefit `401/403` still needs its own role check. A failure in an agent tool catalog before an Azure request requires Cloudgeni support, not another Azure role.