Azure Cloud Account Setup

Connect Azure to Spotto by choosing the setup path that matches how your team manages Azure access.

Before You Start

Decide who will run the setup and how your organization wants Azure changes to be made:

• Use Automatic Azure Connect when an Azure or Entra admin can complete setup in the Spotto portal.
• Use PowerShell Script when an Azure admin wants a guided local script.
• Use Terraform Module when Azure access is managed as infrastructure as code.
• Use Manual Azure Portal Setup only when each Azure change must be reviewed and applied by hand.
• Use Azure Guest Assessment Access for a read-only, on-demand assessment without a durable service-principal connection.
• Use Granular Delegated Admin Privileges when an MSP or CSP partner wants to connect customer tenants through Microsoft Partner Center.

Choose Your Setup Path

Path	Best For	What Spotto Gets
Automatic Azure Connect	Most teams that can sign in as an Azure or Entra admin	Spotto creates or reuses the service principal, assigns recommended access, configures billing exports where enabled, validates access, and saves the cloud account.
PowerShell Script	Azure admins who prefer running a local guided script	The script creates or reuses the service principal, assigns roles, grants Graph access, configures billing exports, and outputs the values needed in Spotto.
Terraform Module	Teams that manage Azure onboarding through infrastructure as code	Terraform creates the service principal, Azure role assignments, optional billing exports, and outputs the values needed in Spotto.
Manual Azure Portal Setup	Teams that must make each Azure change by hand	You create the app registration, assign each role, configure billing exports, grant blob read access, then enter credentials in Spotto.
Azure Guest Assessment Access	MSP and consulting assessments using an invited person	The customer grants Reader on the intended subscriptions, or on a scoped management group, for a read-only on-demand assessment. No durable service-principal connection is created.
Granular Delegated Admin Privileges	MSP or CSP partners managing customer tenants through Partner Center	Spotto reuses a partner authorization profile and creates one GDAP cloud account per customer. Azure subscription access still depends on the active GDAP relationship, partner security group assignments, and Azure RBAC or CSP visibility.

Operator Permissions And PIM

The person running setup needs temporary Azure, Entra, billing, and storage privileges that are broader than the read-only permissions Spotto keeps afterward.

Review Operator Permissions And PIM before setup if your organization uses Privileged Identity Management, just-in-time access, approval workflows, or separate Azure admin teams.

Recommended Path

Use Automatic Azure Connect for durable monitoring unless your organization requires local scripts, Terraform, manual approval for each Azure change, or a Partner Center GDAP relationship. Use Azure Guest Assessment Access when the goal is a read-only, on-demand assessment rather than a durable connection.

The automatic, PowerShell, and Terraform paths all aim for the same recommended Azure end state:

• Reader access on selected subscriptions, or inherited Reader access when onboarding all subscriptions.
• Reader and Management Group Reader at the root management group.
• Reservations Reader, Reservations Contributor, and Savings plan Reader at their provider scopes.
• Microsoft Graph governance permissions with admin consent for service principal, app registration, Global Admin/PIM, group, user, and audit visibility.
• Optional Monitoring Reader and Log Analytics Reader for monitoring and workspace-backed analysis.
• Cost Management exports to customer-owned Azure Storage.
• Storage Blob Data Reader on the billing export container.

Manual Setup Warning

Manual setup is the easiest path to miss a step. If you use the Manual Azure Portal Setup, make sure you complete the Billing Export Setup for every subscription you want Spotto to analyze.

Without Cost Management exports and Storage Blob Data Reader on the export container, billing ingestion can be incomplete even when basic Azure credential validation succeeds. If the export is at billing scope, Spotto also needs read access at that exact billing scope.

Common Follow-Up Links

• Add Or Update The Azure Account In Spotto
• Missing Permission Warnings
• CSP Billing Prerequisites
• Troubleshooting

Add Or Update The Azure Account In Spotto

If your setup path gives you a tenant ID, client ID, and client secret, enter them in Spotto from Connectors -> Connectors -> Cloud Accounts. Full steps are in Add Or Update The Azure Account In Spotto.

Missing Permission Warnings

If Spotto shows Permission required in sync diagnostics, use the permission warning reference.

Configure Cost Management Exports To Storage

Manual billing export steps are now documented in Manual Azure Portal Setup.

Billing Prerequisites For CSP / Azure Plan Subscriptions

CSP billing visibility requirements are documented in CSP Billing Prerequisites.