Azure Onboarding Operator Permissions Guide

This page describes the permissions needed by the person running setup. These are not the same as the permissions granted to the Spotto service principal.

Two Permission Sets

Azure onboarding uses two different permission sets:

Permission Set	Who Uses It	Purpose
Setup operator permissions	The Azure or Entra admin running Automatic Azure Connect, PowerShell Script, Terraform Module, or Manual Azure Portal Setup	Create the app registration, grant consent, assign Azure roles, and configure billing exports.
Spotto service-principal permissions	The Spotto app registration/service principal	Read Azure resources, governance, commitments, billing export files, and optional monitoring data after setup.

The setup operator can use temporary privileged access. The Spotto service principal keeps only the access required for ongoing analysis.

Recommended Operator Access

For the smoothest setup, use an account that can temporarily activate these privileges:

Setup Area	Operator Needs
Spotto portal setup	A Spotto user with permission to manage cloud accounts for the company.
App registration and service principal	Permission to create or update app registrations and service principals in the target tenant. Common examples are Application Administrator, Cloud Application Administrator, or Global Administrator, depending on tenant policy.
Microsoft Graph governance admin consent	A tenant role allowed to grant application permissions. In many tenants this requires Privileged Role Administrator or Global Administrator, and some tenants allow Cloud Application Administrator depending on consent policy.
Subscription Reader assignments	Owner, User Access Administrator, or Role Based Access Control Administrator at each subscription, or at an inherited parent scope. Contributor is not enough to assign roles.
Management group assignments	Owner, User Access Administrator, or Role Based Access Control Administrator at the exact root management group, or at each visible management group the setup should process. Visibility alone is not role-assignment authority.
Azure Policy exemption custom roles	Microsoft.Authorization/roleDefinitions/write and Microsoft.Authorization/roleAssignments/write at every selected subscription and management group. Owner or User Access Administrator provides both; Role Based Access Control Administrator alone cannot create custom role definitions.
Reservations Reader and Reservations Contributor assignments	Permission to assign roles at /providers/Microsoft.Capacity.
Savings plan Reader assignment	Permission to assign roles at /providers/Microsoft.BillingBenefits.
Cost Management exports	Owner is the simplest role for full automation. If Owner is not available, use Contributor plus User Access Administrator at each exact subscription or management-group export scope. Billing-hierarchy scopes use their matching EA or MCA billing roles. User Access Administrator alone can assign RBAC roles but cannot create Cost Management exports, resource groups, storage accounts, or containers.
Billing-scope export discovery	If an export already exists at billing scope, permission to grant Spotto read access at that exact billing scope. Use Cost Management Reader for Azure RBAC cost scopes, or the matching billing-reader role for MCA or EA scopes.
Export storage	Permission in the subscription that hosts the destination storage account, which can differ from the subscriptions being analyzed. Owner is simplest. If using separate least-privilege roles, Contributor covers storage changes and User Access Administrator covers the Storage Blob Data Reader assignment. For storage accounts with firewall rules, Azure may require Owner or a custom role with Microsoft.Authorization/roleAssignments/write and Microsoft.Authorization/permissions/read.
Spotto read access to export files	Permission to assign Storage Blob Data Reader to the Spotto service principal on the export container or storage account.

If one person cannot activate all of these privileges, split the setup between the relevant Azure, Entra, billing, and storage administrators.

Using PIM Or Just-In-Time Access

Microsoft Entra Privileged Identity Management (PIM) works well for Spotto setup. The operator does not need permanent Owner or Global Administrator access if your organization allows eligible role activation.

Before starting setup:

1. Run Setup-SpottoAzure.ps1 and choose Check prerequisites (no Azure changes) to inventory active Azure RBAC and eligible Azure resource roles for the selected tenant.
2. Activate any Azure resource PIM roles identified by the report, reconnect the Azure session, and rerun the prerequisite check until those scopes show active access.
3. Manually confirm and activate the required Microsoft Entra role, such as Application Administrator, Cloud Application Administrator, Privileged Role Administrator, or Global Administrator. The checker does not request the extra Microsoft Graph access needed to inspect Entra directory-role PIM.
4. Activate Owner at each subscription, management group, billing/provider, or storage scope where setup will make changes. The PowerShell all-subscriptions path can also use tenant-root (/) authority for inherited Reader; Automatic Connect does not request that tenant-root assignment.
5. If Owner is not available, activate both Contributor and User Access Administrator at the selected subscription or inherited parent scope. Contributor lets the setup create or update billing exports and storage resources; User Access Administrator lets it assign RBAC roles to the Spotto service principal.
6. Do not rely on User Access Administrator alone when billing export setup is enabled. It can assign roles, but it cannot create Cost Management exports, resource groups, storage accounts, or containers.
7. If your access comes through PIM for Groups, activate the group first, then activate the Azure resource role if required.
8. Wait for role activation to appear in Azure Portal and Microsoft Entra admin center.
9. Start setup only after the active role is visible at every required scope.

note

If the prerequisite check returns no eligible Azure resource roles, that does not prove PIM is disabled. It means Azure returned no current or upcoming eligible resource-role schedules for the signed-in account. The report also distinguishes reservation inventory visibility from authority to grant Reservations Reader at /providers/Microsoft.Capacity.

important

PIM activation is time-bound. Choose an activation window long enough to finish setup, billing export configuration, validation, and any retries. If activation expires during setup, role assignments or billing export steps can fail partway through.

Practical PIM Checklist

Use this checklist before running Automatic Azure Connect or PowerShell Script:

• Entra app-management role is active.
• Graph admin-consent role is active if granting Microsoft Graph governance permissions.
• Owner is active at every selected subscription, or both Contributor and User Access Administrator are active when Owner is not available.
• User Access Administrator alone is only enough for RBAC assignment work, not billing export or storage creation.
• Azure RBAC assignment authority is active at the root management group for Automatic Connect, or at every intended visible management group when the root group is unavailable. For PowerShell all-subscriptions setup, tenant-root (/) authority is optional because the script falls back to every selected subscription.
• Owner, User Access Administrator, or an equivalent custom operator role is active at every selected policy-exemption scope when enabling exemption writes.
• Billing/export permissions are active at each selected subscription or billing scope.
• Storage permissions are active for the chosen export storage account and container.
• PIM approval is complete before starting the setup flow.
• Activation duration covers the full setup, not just sign-in.

If Setup Fails After PIM Activation

If setup fails even though access was activated:

1. Reconnect Azure PowerShell, rerun the prerequisite check, and confirm that the affected scope now reports active access rather than PIM eligible.
2. Sign out and sign back in to Azure and Spotto if the portal cached the pre-activation access state.
3. Confirm the role is active at the exact scope where the failed operation runs.
4. Check whether the failed operation is at a provider scope, such as reservations or savings plans, rather than a normal subscription scope.
5. Confirm Graph admin consent is active and allowed by tenant consent policy.
6. Confirm the storage account does not block Cost Management export writes or Spotto reads.
7. Rerun setup after the role activation is visible.

Least-Privilege Notes

• Use PIM/JIT activation instead of standing Owner or Global Administrator access where possible.
• Activate only the scopes needed for the selected subscriptions and billing export storage.
• Deactivate roles after setup if your PIM policy does not expire them automatically.
• Keep the Spotto service-principal access separate from the human operator's temporary setup privileges.