Azure Manual Support Access: Read-Only Roles

Overview

This guide explains how to grant read-only access to Spotto support personnel for manual support, investigations, validations, and demonstrations in your Azure environment.

info

This page is for manual human support access. For an on-demand automated assessment using an invited person, use Azure Guest Assessment Access. For a durable service-principal connection, use Azure Cloud Account Setup.

Why Grant Support Access?

Unlike the Azure cloud account setup, this approach grants access to human consultants who can:

• Investigate issues directly in your Azure Portal
• Validate configurations and troubleshoot problems
• Showcase Spotto features with live demonstrations
• Provide hands-on support during onboarding and optimization
• Review compliance settings and Azure Policies
• Assist with complex scenarios that require manual investigation

Choose the correct access path

Access path	Use it for	Access model
Durable Azure cloud account	Continuous monitoring and recommendations	Service principal or GDAP relationship
Guest assessment access	Automated, read-only, on-demand assessment	Invited person authenticates for the assessment
Manual support access	Portal investigation and direct support	Invited person works interactively in Azure

Setup Read-Only Access for Support Personnel

Follow these steps to grant secure read-only access to Spotto support personnel:

1. Invite External User (Spotto User)

1. Go to the Azure Portal and sign in.
2. Search for and select Microsoft Entra ID.
3. Under Manage, select Users.
4. Click New user > Invite external user (Invite an external user to collaborate with your organization).
5. Enter the name and email address provided by Spotto support (e.g., [email protected]).
6. Click Review + Invite.

info

Assign Global Reader only when the support scope includes Microsoft Entra identity or governance review. Subscription-only resource investigation does not require it.

2. Optionally Assign Global Reader

If the support scope includes Microsoft Entra governance, enterprise applications, or service-principal credential expiry:

1. In the Azure portal, search for and select Microsoft Entra ID, then open Roles & admins.
2. Select Global Reader.
3. Add the invited person to the role.

Global Reader permits directory inspection but does not allow changes or reveal secret values.

3. Assign Reader Role to Subscriptions

For each Azure subscription you want support personnel to access:

1. Navigate to, or search for Subscriptions and select the desired subscription.
2. Open Access Control (IAM) from the left-hand menu.
3. Click Add > Add role assignment.
4. In the Role dropdown, select Reader.
5. In Assign access to, choose User, group, or service principal.
6. Click Select members, find the invited support user (e.g., [email protected]), and click Select.
7. Click Review + assign to confirm.

Repeat for each subscription you want Spotto support to access.

Repeat for each subscription you want support personnel to access.

What Support Personnel Can Access

With these permissions, support personnel can:

Read-Only Access to:

• Resource configurations and settings
• Cost and usage data
• Performance metrics and diagnostics
• Security configurations and compliance status
• Network configurations and connectivity
• Storage accounts and data structures
• Identity and access management settings

Cannot Access:

• Modify any resources or configurations
• Delete or create new resources
• Read workload data such as Storage blobs, Key Vault secret values, or database rows through the Reader role
• Change permissions or roles
• Billing information or payment details

Security and Privacy

• Read-only permissions ensure no accidental changes
• Time-limited access can be revoked at any time
• Audit trail shows all access and activities
• Agreed data handling for any screenshots, exports, or notes created during the support engagement
• Immediate revocation available through Azure AD

Managing Support Access

To Revoke Access:

1. Go to Users in Azure Portal
2. Find the support user account
3. Click Delete to remove the user
4. Or remove specific role assignments as needed

To Modify Permissions:

1. Go to Users and select the support user
2. Navigate to Assigned roles
3. Add or remove role assignments as required

You're Ready for Support!

Once access is granted, Spotto support personnel can:

• Investigate issues directly in your environment
• Provide live demonstrations of Spotto features
• Validate configurations and troubleshoot problems
• Assist with optimization and best practices
• Support compliance and governance requirements

For immediate support or questions about access setup, please Contact Us.

Troubleshooting

The invited user can’t see subscriptions or resources

What you're seeing: The support user can sign in but can’t browse the subscriptions/resources you expected.
Likely causes:

• The Reader role was not assigned at the subscription scope (or was assigned to the wrong subscription).
• Role assignment hasn’t propagated yet. How to fix:

1. Verify the user has Reader assigned on each required subscription under Access Control (IAM).
2. Wait 5–10 minutes for Azure role propagation and retry.
3. Confirm you invited the correct user email address.