Operator Permissions And PIM

This page describes the permissions needed by the person running setup. These are not the same as the permissions granted to the Spotto service principal.

Two Permission Sets

Azure onboarding uses two different permission sets:

Permission Set	Who Uses It	Purpose
Setup operator permissions	The Azure or Entra admin running Automatic Azure Connect, PowerShell Script, Terraform Module, or Manual Azure Portal Setup	Create the app registration, grant consent, assign Azure roles, and configure billing exports.
Spotto service-principal permissions	The Spotto app registration/service principal	Read Azure resources, governance, commitments, billing export files, and optional monitoring data after setup.

The setup operator can use temporary privileged access. The Spotto service principal keeps only the access required for ongoing analysis.

Recommended Operator Access

For the smoothest setup, use an account that can temporarily activate these privileges:

Setup Area	Operator Needs
Spotto portal setup	A Spotto user with permission to manage cloud accounts for the company.
App registration and service principal	Permission to create or update app registrations and service principals in the target tenant. Common examples are Application Administrator, Cloud Application Administrator, or Global Administrator, depending on tenant policy.
Microsoft Graph governance admin consent	A tenant role allowed to grant application permissions. In many tenants this requires Privileged Role Administrator or Global Administrator, and some tenants allow Cloud Application Administrator depending on consent policy.
Subscription Reader assignments	Owner, User Access Administrator, or Role Based Access Control Administrator at each subscription, or at an inherited parent scope. Contributor is not enough to assign roles.
Root management group assignments	Owner, User Access Administrator, or Role Based Access Control Administrator at the root management group or tenant root scope.
Reservations Reader and Reservations Contributor assignments	Permission to assign roles at /providers/Microsoft.Capacity.
Savings plan Reader assignment	Permission to assign roles at /providers/Microsoft.BillingBenefits.
Cost Management exports	Owner is the simplest role for full automation. If Owner is not available, use Contributor plus User Access Administrator at each selected subscription or inherited parent scope. User Access Administrator alone can assign RBAC roles but cannot create Cost Management exports, resource groups, storage accounts, or containers.
Billing-scope export discovery	If an export already exists at billing scope, permission to grant Spotto read access at that exact billing scope. Use Cost Management Reader for Azure RBAC cost scopes, or the matching billing-reader role for MCA or EA scopes.
Export storage	Permission to create or update the storage account and blob container. Owner is simplest. If using separate least-privilege roles, Contributor covers storage changes and User Access Administrator covers the Storage Blob Data Reader role assignment. For storage accounts with firewall rules, Azure may require Owner on the storage account or a custom role with Microsoft.Authorization/roleAssignments/write and Microsoft.Authorization/permissions/read.
Spotto read access to export files	Permission to assign Storage Blob Data Reader to the Spotto service principal on the export container or storage account.

If one person cannot activate all of these privileges, split the setup between the relevant Azure, Entra, billing, and storage administrators.

Using PIM Or Just-In-Time Access

Microsoft Entra Privileged Identity Management (PIM) works well for Spotto setup. The operator does not need permanent Owner or Global Administrator access if your organization allows eligible role activation.

Before starting setup:

1. Activate the required Microsoft Entra role, such as Application Administrator, Cloud Application Administrator, Privileged Role Administrator, or Global Administrator.
2. Activate Owner at the subscription, management group, tenant root, billing/provider, or storage scope where setup will make changes. This is the simplest role for full automated setup.
3. If Owner is not available, activate both Contributor and User Access Administrator at the selected subscription or inherited parent scope. Contributor lets the setup create or update billing exports and storage resources; User Access Administrator lets it assign RBAC roles to the Spotto service principal.
4. Do not rely on User Access Administrator alone when billing export setup is enabled. It can assign roles, but it cannot create Cost Management exports, resource groups, storage accounts, or containers.
5. If your access comes through PIM for Groups, activate the group first, then activate the Azure resource role if required.
6. Wait for role activation to appear in Azure Portal and Microsoft Entra admin center.
7. Start setup only after the active role is visible at every required scope.

important

PIM activation is time-bound. Choose an activation window long enough to finish setup, billing export configuration, validation, and any retries. If activation expires during setup, role assignments or billing export steps can fail partway through.

Practical PIM Checklist

Use this checklist before running Automatic Azure Connect or PowerShell Script:

• Entra app-management role is active.
• Graph admin-consent role is active if granting Microsoft Graph governance permissions.
• Owner is active at every selected subscription, or both Contributor and User Access Administrator are active when Owner is not available.
• User Access Administrator alone is only enough for RBAC assignment work, not billing export or storage creation.
• Azure RBAC assignment role is active at the root management group if using tenant-wide or governance setup.
• Billing/export permissions are active at each selected subscription or billing scope.
• Storage permissions are active for the chosen export storage account and container.
• PIM approval is complete before starting the setup flow.
• Activation duration covers the full setup, not just sign-in.

If Setup Fails After PIM Activation

If setup fails even though access was activated:

1. Sign out and sign back in to Azure and Spotto if the portal cached the pre-activation access state.
2. Confirm the role is active at the exact scope where the failed operation runs.
3. Check whether the failed operation is at a provider scope, such as reservations or savings plans, rather than a normal subscription scope.
4. Confirm Graph admin consent is active and allowed by tenant consent policy.
5. Confirm the storage account does not block Cost Management export writes or Spotto reads.
6. Rerun setup after the role activation is visible.

Least-Privilege Notes

• Use PIM/JIT activation instead of standing Owner or Global Administrator access where possible.
• Activate only the scopes needed for the selected subscriptions and billing export storage.
• Deactivate roles after setup if your PIM policy does not expire them automatically.
• Keep the Spotto service-principal access separate from the human operator's temporary setup privileges.