Azure Support Access

This guide explains how to grant read-only access to Spotto support personnel for manual support, investigations, validations, and demonstrations in your Azure environment.

Why Grant Support Access?

Unlike the automated service principal setup, this approach grants access to human consultants who can:

• Investigate issues directly in your Azure Portal
• Validate configurations and troubleshoot problems
• Showcase Spotto features with live demonstrations
• Provide hands-on support during onboarding and optimization
• Review compliance settings and Azure Policies
• Assist with complex scenarios that require manual investigation

Automated vs Manual Access

Automated Access	Manual Support Access
Service principal with read-only permissions	Human user with read-only permissions
Used by Spotto AI for automated analysis	Used by support personnel for manual assistance
Continuous monitoring and recommendations	On-demand support and investigations
No human interaction required	Direct collaboration with support team

Setup Read-Only Access for Support Personnel

Follow these steps to grant secure read-only access to Spotto support personnel:

1. Invite External User (Spotto User)

1. Go to the Azure Portal and sign in.
2. Search for Users in the search bar.
3. Click New user > Invite external user (Invite an external user to collaborate with your organization).
4. Enter the name and email address provided by Spotto support (e.g., [email protected]).
5. Click on the Assignments tab > Add Role.
6. Search for and select Global Reader role.
7. Click Review + Invite.

info

The Global Reader role is essential for support personnel to understand your organization's governance structure and compliance requirements.

2. Assign Reader Role to Subscriptions

For each Azure subscription you want support personnel to access:

1. Navigate to, or search for Subscriptions and select the desired subscription.
2. Open Access Control (IAM) from the left-hand menu.
3. Click Add > Add role assignment.
4. In the Role dropdown, select Reader.
5. In Assign access to, choose User, group, or service principal.
6. Click Select members, find the invited support user (e.g., [email protected]), and click Select.
7. Click Review + assign to confirm.

Repeat for each subscription you want Spotto support to access.

Repeat for each subscription you want support personnel to access.

What Support Personnel Can Access

With these permissions, support personnel can:

Read-Only Access to:

• Resource configurations and settings
• Cost and usage data
• Performance metrics and diagnostics
• Security configurations and compliance status
• Network configurations and connectivity
• Storage accounts and data structures
• Identity and access management settings

Cannot Access:

• Modify any resources or configurations
• Delete or create new resources
• Access sensitive data or secrets
• Change permissions or roles
• Billing information or payment details

Security and Privacy

• Read-only permissions ensure no accidental changes
• Time-limited access can be revoked at any time
• Audit trail shows all access and activities
• No data extraction - support personnel work within your environment
• Immediate revocation available through Azure AD

Managing Support Access

To Revoke Access:

1. Go to Users in Azure Portal
2. Find the support user account
3. Click Delete to remove the user
4. Or remove specific role assignments as needed

To Modify Permissions:

1. Go to Users and select the support user
2. Navigate to Assigned roles
3. Add or remove role assignments as required

You're Ready for Support!

Once access is granted, Spotto support personnel can:

• Investigate issues directly in your environment
• Provide live demonstrations of Spotto features
• Validate configurations and troubleshoot problems
• Assist with optimization and best practices
• Support compliance and governance requirements

For immediate support or questions about access setup, please Contact Us.