Skip to main content

Azure Cloud Account Setup: Choose a Path

Connect Azure to Spotto by choosing the setup path that matches how your team manages Azure access.

Before You Start​

Decide who will run the setup and how your organization wants Azure changes to be made:

If you are using GDAP, read How Azure Access Actually Works before requesting a relationship. GDAP roles, Azure access, and CSP billing visibility are three separate grants, and the roles requested on a relationship cannot be changed after the customer approves it.

Choose Your Setup Path​

PathBest ForWhat Spotto Gets
Automatic Azure ConnectMost teams that can sign in as an Azure or Entra adminSpotto creates or reuses the service principal, assigns recommended access, configures billing exports where enabled, validates access, and saves the cloud account.
PowerShell ScriptAzure admins who prefer running a local guided scriptThe script creates or reuses the service principal, assigns roles, grants Graph access, configures billing exports, and outputs the values needed in Spotto.
Terraform ModuleTeams that manage Azure onboarding through infrastructure as codeTerraform creates the service principal, Azure role assignments, optional billing exports, and outputs the values needed in Spotto.
Manual Azure Portal SetupTeams that must make each Azure change by handYou create the app registration, assign each role, configure billing exports, grant blob read access, then enter credentials in Spotto.
Azure Guest Assessment AccessMSP and consulting assessments using an invited personThe customer grants Reader on the intended subscriptions, or on a scoped management group, for a read-only on-demand assessment. No durable service-principal connection is created.
Granular Delegated Admin PrivilegesMSP or CSP partners managing customer tenants through Partner CenterSpotto reuses a partner authorization profile and creates one GDAP cloud account per customer. Azure subscription access still depends on the active GDAP relationship, partner security group assignments, and Azure RBAC or CSP visibility.

Operator Permissions And PIM​

The person running setup needs temporary Azure, Entra, billing, and storage privileges that are broader than the read-only permissions Spotto keeps afterward.

Review Operator Permissions And PIM before setup if your organization uses Privileged Identity Management, just-in-time access, approval workflows, or separate Azure admin teams.

Use Automatic Azure Connect for durable monitoring unless your organization requires local scripts, Terraform, manual approval for each Azure change, or a Partner Center GDAP relationship. Use Azure Guest Assessment Access when the goal is a read-only, on-demand assessment rather than a durable connection.

The durable service-principal paths aim for the same core read permissions, but billing export defaults differ. Automatic setup recommends exports, PowerShell configures them through its Custom profile, and Terraform enables them only when selected in module configuration.

The shared Azure end state includes:

  • Reader access on every selected subscription. Automatic setup also assigns Reader at the root management group; the PowerShell all-subscriptions path can use inherited Reader at tenant scope (/).
  • Security Reader on every selected subscription for Defender for Cloud assessments, secure score, and security posture.
  • Management Group Reader at the root management group.
  • Key Vault Reader at covering management-group and selected-subscription scopes for secret, key, and certificate expiry metadata, without secret-value or private-key access.
  • Reservations Reader and Savings plan Reader at their provider scopes.
  • Microsoft Graph governance permissions with admin consent for service principal, app registration, Global Admin/PIM, group, user, audit, tenant policy, and subscribed-license visibility.
  • Optional Monitoring Reader and Log Analytics Reader for monitoring and workspace-backed analysis.
  • Optional Reservations Contributor for reservation refund quotes and reservation management workflows.
  • When billing exports are enabled, Cost Management exports to customer-owned Azure Storage and Storage Blob Data Reader on the destination container.

Manual Setup Warning​

Manual setup is the easiest path to miss a step. If you use the Manual Azure Portal Setup, grant the complete Microsoft Graph application-permission set, including Policy.Read.All and LicenseAssignment.Read.All, and provide billing export coverage for the subscriptions you want Spotto to analyze.

Without readable Cost Management exports and Storage Blob Data Reader on the export destination, Spotto relies on Azure billing APIs for available dates and may have incomplete history even when basic credential validation succeeds. If the export is at management-group or billing scope, Spotto also needs read access at that exact scope.

Add Or Update The Azure Account In Spotto​

If your setup path gives you a tenant ID, client ID, and client secret, enter them in Spotto from Connectors -> Connectors -> Cloud Accounts. Full steps are in Add Or Update The Azure Account In Spotto.

Missing Permission Warnings​

If Spotto shows Permission required in sync diagnostics, use the permission warning reference.

Configure Cost Management Exports To Storage​

Manual billing export steps are now documented in Manual Azure Portal Setup.

Billing Prerequisites For CSP / Azure Plan Subscriptions​

CSP billing visibility requirements are documented in CSP Billing Prerequisites.