Skip to main content

Manual Azure Portal Setup

Manual setup is for teams that must make each Azure change directly in the Azure Portal.

If you can use an automated path, use Automatic Azure Connect, PowerShell Script, or Terraform Module instead.

Before starting, confirm the person making the Azure changes has the required temporary setup privileges. If your organization uses PIM or just-in-time access, see Operator Permissions And PIM.

For billing export setup, User Access Administrator alone is not enough. It can assign Azure RBAC roles, but it cannot create or update Cost Management exports, resource groups, storage accounts, or containers. Use Owner for full setup, or Contributor plus User Access Administrator if your organization separates resource changes from RBAC assignment.

Required Permission Summary​

For full onboarding, configure this baseline permission set for the Spotto service principal:

  • Reader on each subscription you want Spotto to analyze, or inherited Reader access from the tenant root or root management group.
  • Reader at the root management group.
  • Management Group Reader at the root management group.
  • Reservations Reader at the reservations provider scope.
  • Reservations Contributor at the reservations provider scope for reservation refund quotes and reservation management workflows.
  • Savings plan Reader at the savings plans provider scope.
  • Microsoft Graph governance application permissions with admin consent.
  • Cost Management exports to customer-owned Azure Storage.
  • Storage Blob Data Reader on the export container.

Recommended add-ons:

  • Monitoring Reader for Azure Monitor metrics, alerts, diagnostics, and Application Insights.
  • Log Analytics Reader for workspace log analysis.

1. Create an Entra ID Application​

  1. Go to the Azure Portal and sign in.
  2. Search for Entra ID and open Microsoft Entra ID.
  3. Open App registrations.
  4. Select New registration.
  5. Enter a name, for example Spotto.
  6. Under Supported account types, choose Accounts in this organizational directory only.
  7. Leave the Redirect URI blank.
  8. Select Register.

Record:

  • Application (client) ID
  • Directory (tenant) ID

2. Create a Client Secret​

  1. In the app registration, open Certificates & secrets.
  2. Under Client secrets, select New client secret.
  3. Enter a description, for example SpottoSecret.
  4. Choose an expiry period. Twelve months is recommended.
  5. Select Add.
  6. Copy the Client Secret Value immediately.
  7. Record the secret expiry date.
info

Azure shows the client secret value only once. Do not copy the secret ID instead of the secret value.

3. Assign Reader On Subscriptions​

Assign Reader on each subscription Spotto should analyze.

  1. In Azure, open Subscriptions.
  2. Select the subscription.
  3. Open Access Control (IAM).
  4. Select Add -> Add role assignment.
  5. Select Reader.
  6. For Assign access to, choose User, group, or service principal.
  7. Select the Spotto app registration/service principal.
  8. Select Review + assign.

If you are onboarding all subscriptions and your tenant uses inherited management group access, assign Reader at the tenant root or root management group instead.

4. Assign Root Management Group Access​

These roles let Spotto read the tenant governance hierarchy, Azure Policy metadata, and RBAC metadata.

  1. In Azure, search for Management groups.
  2. Open the tenant root group or root management group.
  3. Open Access control (IAM).
  4. Add Reader for the Spotto service principal.
  5. Repeat the flow and add Management Group Reader for the same service principal.

5. Assign Monitoring Roles​

This step is optional but recommended.

  1. Open each subscription where Spotto should read monitoring data.
  2. Open Access Control (IAM).
  3. Assign Monitoring Reader to the Spotto service principal.
  4. Assign Log Analytics Reader to the same service principal if Spotto should query workspace-backed data.

For tenant-wide inherited workspace log access, assign Log Analytics Reader at the root management group instead of repeating it per subscription.

6. Assign Reservation Roles​

Reservations are tenant-level resources with their own RBAC path. Subscription Reader is not enough.

  1. In Azure, search for Reservations.
  2. Open Access control (IAM).
  3. Add Reservations Reader for the Spotto service principal.
  4. Add Reservations Contributor for the same service principal.

Reservations Reader lets Spotto discover reservation orders and reservation details. Reservations Contributor lets Spotto calculate reservation refund quotes and support reservation management workflows. It does not allow the service principal to delegate reservation RBAC roles.

7. Assign Savings Plan Reader​

  1. In Azure, search for Savings plans.
  2. Open Access control (IAM).
  3. Add Savings plan Reader for the Spotto service principal.

8. Grant Microsoft Graph Governance Permissions​

These Graph permissions let Spotto read applications, service principals, directory roles, Global Admin/PIM state, group membership, users, and audit logs for governance and credential posture.

  1. Open the Spotto app registration.
  2. Open API permissions.
  3. Select Add a permission.
  4. Choose Microsoft Graph.
  5. Choose Application permissions.
  6. Add these application permissions:
    • Application.Read.All
    • RoleAssignmentSchedule.Read.Directory
    • RoleEligibilitySchedule.Read.Directory
    • RoleManagement.Read.Directory
    • GroupMember.Read.All
    • User.Read.All
    • AuditLog.Read.All
  7. Select Add permissions.
  8. Select Grant admin consent for your tenant.
  9. Confirm consent has been granted.

9. Configure Cost Management Exports To Storage​

Cost Management exports let Azure write daily billing files to customer-owned Azure Storage. Spotto reads those files later using the configured service principal.

Manual setup must include this step for every subscription where you want complete billing ingestion.

The setup operator needs permission to:

  • Create or update Microsoft.CostManagement/exports at the subscription or billing scope.
  • Assign the Spotto service principal read access at the export scope if the export is created at billing scope instead of subscription scope.
  • Create or update the target storage account and blob container.
  • Configure the export destination. Azure may require Owner on the storage account, or a custom role with Microsoft.Authorization/roleAssignments/write and Microsoft.Authorization/permissions/read, especially when the storage account has firewall rules.
  • Assign Storage Blob Data Reader on the export container or storage account to the Spotto service principal.

In PIM environments, activate Owner for the export subscription/storage scope, or activate both Contributor and User Access Administrator. Contributor covers export and storage resource changes; User Access Administrator covers the RBAC assignments.

info

Azure Cost Management export writes and Spotto billing reads are separate access paths. Azure needs permission to write export files into storage. Spotto needs Storage Blob Data Reader so it can read those files later without storage keys or SAS tokens.

Microsoft's Azure-native references:

Create Or Select Export Storage​

  1. Create or select a StorageV2 storage account for billing exports.
  2. Create or select a private blob container, for example spotto-cost-exports.
  3. Keep anonymous blob access disabled.
  4. Keep public network access enabled for the normal Spotto-supported export-read path.
  5. If your organization requires storage firewall rules, confirm both the Azure Cost Management export job and the Spotto service principal can access the container before relying on the export.

Create Daily Cost Management Exports​

Repeat this for each subscription Spotto should analyze.

  1. In Azure, open Cost Management + Billing or Cost Management.
  2. Select the subscription scope.
  3. Open Exports.
  4. Select Create.
  5. Choose a cost and usage export template, or create your own export.
  6. Add a Cost and usage details (Actual) export.
  7. Set frequency to daily.
  8. Set timeframe to month-to-date.
  9. Set destination to Azure blob storage.
  10. Select the export storage account and container.
  11. Use a path that identifies the subscription and dataset, for example spotto/<subscription-id>/actual/recurring.
  12. Choose CSV format and Gzip compression.
  13. Leave file partitioning enabled where supported.
  14. Keep overwrite behavior enabled for daily exports.
  15. Create the export.
  16. Run the export immediately if Azure offers Run now.

If the Azure agreement supports amortized exports, create a second daily export for Cost and usage details (Amortized) with a path such as spotto/<subscription-id>/amortized/recurring.

For historical billing data, open the export after it is created and use Export selected dates for previous closed months where Azure offers it. Spotto automation targets the previous 13 closed months; manual portal availability depends on the dataset, subscription, billing agreement, and Azure Cost Management support for that scope.

If The Export Is At Billing Scope​

Some organizations create one export at a billing scope such as a billing account, billing profile, invoice section, department, or enrollment. That can cover multiple subscriptions.

If you use a billing-scope export:

  • Assign Spotto read access at that exact billing scope so it can discover the export later.
  • For Azure RBAC cost scopes, assign Cost Management Reader.
  • For Microsoft Customer Agreement billing scopes, assign the matching billing reader role, such as Billing account reader, Billing profile reader, or Invoice section reader.
  • For Enterprise Agreement billing scopes, assign the equivalent EA read role, such as enrollment or department reader.
  • Still assign Storage Blob Data Reader on the export container or storage account.

Billing-scope read access lets Spotto find the export. Blob data access lets Spotto read the files. Both are needed.

Grant Spotto Read Access To Export Files​

  1. Open the export blob container.
  2. Open Access control (IAM).
  3. Select Add -> Add role assignment.
  4. Select Storage Blob Data Reader.
  5. For Assign access to, choose User, group, or service principal.
  6. Select the Spotto service principal.
  7. Select Review + assign.

Container scope is the narrowest normal assignment. Storage account scope is also supported when you deliberately want the Spotto service principal to read every export container in that account.

If the storage account has public network access disabled or firewall rules that block Spotto cloud-engine, Storage Blob Data Reader is not enough. The service principal still needs a reachable network path to the container.

caution

Do not send Spotto a storage account key or SAS token for this workflow. Spotto reads export files as the configured service principal using Azure RBAC.

Add Or Update Azure Account In Spotto​

  1. Return to the Spotto Portal.
  2. Go to Connectors -> Connectors -> Cloud Accounts.
  3. Choose one path:
    • New account: select Add Cloud Account and choose Manual Setup.
    • Existing account: open the cloud account and select edit.
  4. Enter or update:
    • Name
    • Application (client) ID
    • Directory (tenant) ID
    • Client secret
    • Secret expiry date
  5. Select Validate Credentials.
  6. Save the cloud account.
important

If you are editing an existing cloud account, validation alone does not save changes. After validation succeeds, select Update.

Azure RBAC and Microsoft Graph consent can take 5-15 minutes to propagate. Subscription access may validate before governance, commitment, or billing-related permissions are fully available.

Next Steps​