Skip to main content

Manual Azure Cloud Account Setup: Full Guide

Manual setup is for teams that must make each Azure change directly in the Azure Portal.

If you can use an automated path, use Automatic Azure Connect, PowerShell Script, or Terraform Module instead.

Before starting, confirm the person making the Azure changes has the required temporary setup privileges. If your organization uses PIM or just-in-time access, see Operator Permissions And PIM.

For billing export setup, User Access Administrator alone is not enough. It can assign Azure RBAC roles, but it cannot create or update Cost Management exports, resource groups, storage accounts, or containers. Use Owner for full setup, or Contributor plus User Access Administrator if your organization separates resource changes from RBAC assignment.

Required Permission Summary​

For standard read-only onboarding, configure this baseline permission set for the Spotto service principal:

  • Reader on each subscription you want Spotto to analyze, or inherited Reader access from the tenant root or root management group.
  • Security Reader on each subscription you want Spotto to analyze. Confirm Reader is also assigned directly or inherited.
  • Key Vault Reader at a covering management group or subscription scope so Spotto can monitor secret, key, and certificate expiry metadata.
  • Reader and Management Group Reader at the tenant root management group when available, or at each management group Spotto should analyze.
  • Reservations Reader at the reservations provider scope.
  • Savings plan Reader at the savings plans provider scope.
  • Microsoft Graph governance application permissions with admin consent, including tenant policy and subscribed-license reads.

Optional capabilities:

  • Monitoring Reader for Azure Monitor metrics, alerts, diagnostics, and Application Insights.
  • Log Analytics Reader for workspace log analysis.
  • Reservations Contributor at the reservations provider scope when Spotto should calculate reservation refund quotes or support reservation management workflows.
  • Cost Management exports to customer-owned Azure Storage for export-first billing ingestion.
  • Storage Blob Data Reader on an export container when Cost Management exports are enabled.
  • A separately optional Spotto Policy Exemptions custom role for scoped exemption creation. Inherited initiatives also need the action-only role at their exact management-group assignment scope; see Azure Policy exemption permissions.

1. Create an Entra ID Application​

  1. Go to the Azure Portal and sign in.
  2. Search for Entra ID and open Microsoft Entra ID.
  3. Open App registrations.
  4. Select New registration.
  5. Enter a name, for example Spotto.
  6. Under Supported account types, choose Accounts in this organizational directory only.
  7. Leave the Redirect URI blank.
  8. Select Register.

Record:

  • Application (client) ID
  • Directory (tenant) ID

2. Create a Client Secret​

  1. In the app registration, open Certificates & secrets.
  2. Under Client secrets, select New client secret.
  3. Enter a description, for example SpottoSecret.
  4. Choose an expiry period. Twelve months is recommended.
  5. Select Add.
  6. Copy the Client Secret Value immediately.
  7. Record the secret expiry date.
info

Azure shows the client secret value only once. Do not copy the secret ID instead of the secret value.

3. Assign Reader On Subscriptions​

Assign Reader on each subscription Spotto should analyze.

  1. In Azure, open Subscriptions.
  2. Select the subscription.
  3. Open Access Control (IAM).
  4. Select Add -> Add role assignment.
  5. Select Reader.
  6. For Assign access to, choose User, group, or service principal.
  7. Select the Spotto app registration/service principal.
  8. Select Review + assign.

If you are onboarding all subscriptions and your tenant uses inherited management group access, assign Reader at the tenant root or root management group instead.

4. Assign Management Group Access​

These roles let Spotto read the tenant governance hierarchy, Azure Policy metadata, and RBAC metadata.

  1. In Azure, search for Management groups.
  2. Open the tenant root group when you are authorized to use it. Azure identifies the real tenant root by a management-group ID equal to the Microsoft Entra tenant ID; its display name can be changed.
  3. If tenant root access is unavailable, open each management group Spotto should analyze instead.
  4. Open Access control (IAM).
  5. Add Reader for the Spotto service principal.
  6. Repeat the flow and add Management Group Reader for the same service principal.
  7. Repeat these assignments for each intended management group when you cannot assign them once at tenant root.

5. Assign Key Vault Reader​

Assign Key Vault Reader to let Spotto list secret, key, and certificate metadata, including expiry dates, for proactive expiry notifications. This built-in role cannot read secret values or private key material.

For vaults that use the Azure role-based access control permission model:

  1. Open the management group or subscription that contains the Key Vaults Spotto should monitor.
  2. Open Access control (IAM).
  3. Select Add -> Add role assignment.
  4. Select Key Vault Reader (role ID 21090545-7ca7-4776-b22c-e363652d74d2).
  5. Assign it to the Spotto service principal.

Use the tenant root management group to cover all current and future child subscriptions, or assign the role at each subscription for explicit coverage. Resource-group or individual-vault scope also works when you intentionally need narrower access. See Microsoft's Azure Key Vault RBAC guide.

For a vault that still uses Vault access policy, inherited Azure RBAC does not grant object metadata access. On each such vault, add an access policy for the Spotto service principal with only List under Key permissions, Secret permissions, and Certificate permissions. Do not grant Get for secrets or keys.

Key Vault firewall and private-endpoint rules can still block the metadata requests even when the role or access policy is correct.

Spotto adds enabled secrets, keys, and certificates that have an expiry date to Retirement Tracker, where credentials-expiry alerts can provide advance notification. Collection uses the base-object list endpoints only, so historical versions are not added. Certificate-managed backing secrets and keys are de-duplicated when certificate metadata is available. A partial-access warning means Spotto could inspect only some vaults or object families; it does not mean the other vaults are empty.

important

Expiry is not automatic version failover. Key Vault does not automatically switch a workload back to an older version when the latest object expires. A secret's expiry is informational and an authorized get can still succeed; applications must decide not to use it and rotate their own credentials. An expired key blocks new cryptographic operations such as encrypt and sign, while recovery operations such as decrypt and verify remain available. An expired certificate can still be retrieved, but consumers such as TLS clients can reject it. Automatic renewal happens only when you separately configure a supported key rotation or certificate renewal policy.

Microsoft references: secret expiry behavior, key expiry behavior, and certificate expiry behavior.

6. Assign Monitoring Roles​

This step is optional but recommended.

  1. Open each subscription where Spotto should read monitoring data.
  2. Open Access Control (IAM).
  3. Assign Monitoring Reader to the Spotto service principal.
  4. Assign Log Analytics Reader to the same service principal if Spotto should query workspace-backed data.

Also assign Monitoring Reader and Log Analytics Reader at the tenant root management group when available, or at each intended management group. Keep the subscription assignments when you need guaranteed coverage for the selected subscriptions regardless of management-group visibility.

7. Assign Security Reader​

Assign this read-only role so Spotto can collect Defender for Cloud assessments, secure score, and security posture.

  1. Open each subscription Spotto should analyze.
  2. Open Access Control (IAM).
  3. Assign Security Reader to the Spotto service principal.
  4. Confirm the same service principal also has Reader on the subscription or an inherited scope.

8. Assign Reservation Roles​

Reservations are tenant-level resources with their own RBAC path. Subscription Reader is not enough.

  1. In Azure, search for Reservations.
  2. Open Access control (IAM).
  3. Add Reservations Reader for the Spotto service principal.
  4. If Spotto should calculate reservation refund quotes or support reservation management workflows, add Reservations Contributor for the same service principal.

Reservations Reader is the recommended read-only role and lets Spotto discover reservation orders and reservation details. Reservations Contributor is optional write access. It enables reservation refund quotes and reservation management workflows, but does not allow the service principal to delegate reservation RBAC roles.

9. Assign Savings Plan Reader​

  1. In Azure, search for Savings plans.
  2. Open Access control (IAM).
  3. Add Savings plan Reader for the Spotto service principal.

10. Grant Microsoft Graph Governance Permissions​

These Graph permissions let Spotto read applications, service principals, directory roles, Global Admin/PIM state, group membership, users, audit logs, tenant policy configuration, and subscribed license capabilities for governance, credential, and MFA posture.

  1. Open the Spotto app registration.
  2. Open API permissions.
  3. Select Add a permission.
  4. Choose Microsoft Graph.
  5. Choose Application permissions.
  6. Add these application permissions:
    • Application.Read.All
    • RoleAssignmentSchedule.Read.Directory
    • RoleEligibilitySchedule.Read.Directory
    • RoleManagement.Read.Directory
    • GroupMember.Read.All
    • User.Read.All
    • AuditLog.Read.All
    • Policy.Read.All
    • LicenseAssignment.Read.All
  7. Select Add permissions.
  8. Select Grant admin consent for your tenant.
  9. In Configured permissions, confirm every permission above has type Application and status Granted for your tenant.

Policy.Read.All lets Spotto read tenant policy settings used by governance and MFA posture checks. LicenseAssignment.Read.All lets Spotto read subscribed SKU information so it can interpret which identity and security capabilities are licensed. Both are read-only application permissions; Spotto does not require Directory.Read.All or a Microsoft Graph ReadWrite permission for this collection.

Microsoft references: Microsoft Graph permissions reference and List subscribedSkus.

11. Configure Cost Management Exports To Storage​

Cost Management exports let Azure write daily billing files to customer-owned Azure Storage. Spotto reads those files later using the configured service principal.

Manual setup should provide export coverage for every subscription where you want complete billing ingestion. Coverage can come from a subscription export or from an applicable management-group or billing-scope export that includes multiple subscriptions.

The setup operator needs permission to:

  • Create or update Microsoft.CostManagement/exports at the subscription or billing scope.
  • Assign the Spotto service principal read access at the export scope if the export is created at billing scope instead of subscription scope.
  • Create or update the target storage account and blob container.
  • Configure the export destination. Azure may require Owner on the storage account, or a custom role with Microsoft.Authorization/roleAssignments/write and Microsoft.Authorization/permissions/read, especially when the storage account has firewall rules.
  • Assign Storage Blob Data Reader on the export container or storage account to the Spotto service principal.

In PIM environments, activate Owner for the export subscription/storage scope, or activate both Contributor and User Access Administrator. Contributor covers export and storage resource changes; User Access Administrator covers the RBAC assignments.

info

Azure Cost Management export writes and Spotto billing reads are separate access paths. Azure needs permission to write export files into storage. Spotto needs Storage Blob Data Reader so it can read those files later without storage keys or SAS tokens.

Microsoft's Azure-native references:

Create Or Select Export Storage​

  1. Create or select a StorageV2 storage account for billing exports.
  2. Create or select a private blob container, for example spotto-cost-exports.
  3. Keep anonymous blob access disabled.
  4. Keep public network access enabled for the normal Spotto-supported export-read path.
  5. If your organization requires storage firewall rules, confirm both the Azure Cost Management export job and the Spotto service principal can access the container before relying on the export.

Create Daily Cost Management Exports​

Repeat this for each subscription that is not already covered by an applicable management-group or billing-scope export.

  1. In Azure, open Cost Management + Billing or Cost Management.
  2. Select the subscription scope.
  3. Open Exports.
  4. Select Create.
  5. Choose a cost and usage export template, or create your own export.
  6. Add a Cost and usage details (Actual) export.
  7. Set frequency to daily.
  8. Set timeframe to month-to-date.
  9. Set destination to Azure blob storage.
  10. Select the export storage account and container.
  11. Use a path that identifies the subscription and dataset, for example spotto/<subscription-id>/actual/recurring.
  12. Choose CSV format and Gzip compression.
  13. Leave file partitioning enabled where supported.
  14. Keep overwrite behavior enabled for daily exports.
  15. Create the export.
  16. Run the export immediately if Azure offers Run now.

If the Azure agreement supports amortized exports, create a second daily export for Cost and usage details (Amortized) with a path such as spotto/<subscription-id>/amortized/recurring.

For historical billing data, open the export after it is created and use Export selected dates for previous closed months where Azure offers it. Spotto automation targets the previous 13 closed months; manual portal availability depends on the dataset, subscription, billing agreement, and Azure Cost Management support for that scope.

If The Export Is At Billing Scope​

Some organizations create one export at a billing scope such as a billing account, billing profile, invoice section, department, or enrollment. That can cover multiple subscriptions.

If you use a billing-scope export:

  • Assign Spotto read access at that exact billing scope so it can discover the export later.
  • For Azure RBAC cost scopes, assign Cost Management Reader.
  • For Microsoft Customer Agreement billing scopes, assign the matching billing reader role, such as Billing account reader, Billing profile reader, or Invoice section reader.
  • For Enterprise Agreement billing scopes, assign the equivalent EA read role, such as enrollment or department reader.
  • Still assign Storage Blob Data Reader on the export container or storage account.

Billing-scope read access lets Spotto find the export. Blob data access lets Spotto read the files. Both are needed.

Grant Spotto Read Access To Export Files​

  1. Open the export blob container.
  2. Open Access control (IAM).
  3. Select Add -> Add role assignment.
  4. Select Storage Blob Data Reader.
  5. For Assign access to, choose User, group, or service principal.
  6. Select the Spotto service principal.
  7. Select Review + assign.

Container scope is the narrowest normal assignment. Storage account scope is also supported when you deliberately want the Spotto service principal to read every export container in that account.

If the storage account has public network access disabled or firewall rules that block Spotto cloud-engine, Storage Blob Data Reader is not enough. The service principal still needs a reachable network path to the container.

caution

Do not send Spotto a storage account key or SAS token for this workflow. Spotto reads export files as the configured service principal using Azure RBAC.

Add Or Update Azure Account In Spotto​

  1. Return to the Spotto Portal.
  2. Go to Connectors -> Connectors -> Cloud Accounts.
  3. Choose one path:
    • New account: select Add Cloud Account and choose Manual Setup.
    • Existing account: open the cloud account and select edit.
  4. Enter or update:
    • Name
    • Tenant ID
    • Client ID
    • Client Secret Value
    • Secret Expires At
  5. For a new account created by the PowerShell script, choose PowerShell Setup (marked Recommended) and use Import PowerShell Setup Details at the top of the form. Paste the complete SpottoAzureOnboarding-*.json file; a valid paste imports automatically. If you typed or edited the JSON, select Import Details. Review every imported value before continuing.
  6. Select Validate Connection. Spotto detects accessible exports at subscription, management-group, and billing hierarchy scopes and verifies their exact configured storage destinations.
  7. Select the readable detected exports you want, then choose Add Selected Exports.
  8. If an intended export was not detected, expand Enter or Review Billing Export Details and enter its dataset, Azure scope resource ID, and export name manually.
  9. Enable Provide the storage destination when you know the storage account, container, and root folder. Otherwise, Spotto tries to resolve the destination from the named Azure export.
  10. Save the cloud account.

Billing exports remain technically optional, but API-only cost ingestion is materially slower and more exposed to Azure throttling. When you can manage an existing cloud account, Spotto loads its saved credential-free source coordinates into the editor. Adding detected sources appends them to the visible list; saving a non-empty list replaces the saved source configuration with that complete visible list. Secrets and raw private locators are not returned.

For an older account that reports configured exports but shows no source coordinates, leave the editor empty to preserve the private existing configuration. Add sources only when you intend to replace it, and accept the replacement confirmation when Spotto displays one.

The PowerShell onboarding file can contain a client secret. Import it only on a trusted device and securely delete it when it is no longer needed.

important

If you are editing an existing cloud account, validation alone does not save changes. After validation succeeds, select Update.

Azure RBAC and Microsoft Graph consent can take 5-15 minutes to propagate. Subscription access may validate before governance, commitment, or billing-related permissions are fully available.

See Azure Billing Exports for supported scopes, centralized storage, and Azure billing API fallback behavior.

Next Steps​