Azure Cloud Account Permissions

Spotto can connect to Azure with basic Reader access and still report missing data for specific sync steps. When that happens, Cloud Accounts sync diagnostics can show Permission required for a tenant or subscription capability.

Missing Permission Warnings

Use the table below to map the warning to the Azure permission that needs to be added.

Spotto warning	Azure permission	Assign at	Missing feature impact
GDAP relationship or authorization profile	Active GDAP relationship, active security group assignment, usable partner authorization profile, and Spotto pilot enablement	Microsoft Partner Center relationship, partner security group, and Spotto MSP root company	MSP customer onboarding and delegated tenant scans after GDAP pilot validation is enabled
Subscription Reader	Reader	Subscription or inherited management group	Resource inventory, Resource Graph reads, Advisor import, and activity context
Cost Management Reader	Cost Management Reader and Reader	Subscription	Cost trends, budgets, savings calculations, usage attribution, and cost overlays
Billing export storage access	Active Cost Management exports and Storage Blob Data Reader for Spotto	Subscription export scope, plus export storage container or storage account	Cost Analysis, Cost Tree, dashboard spend widgets, and billing history ingestion
CSP Azure Usage visibility	CSP Azure Usage visibility plus Reader	CSP partner billing account customer policy and subscription	Cost Analysis, Cost Tree, dashboard spend widgets, and billing overlays
Monitoring Reader	Monitoring Reader	Subscription or monitored resource scope	Azure Monitor metrics, performance evidence, rightsizing, alerts, and diagnostics
Security Reader	Security Reader and Reader	Subscription	Defender for Cloud assessments, secure score, and security posture summaries
Management Group Reader	Management Group Reader	Root management group	Management group hierarchy and tenant-level governance context
Reservations Reader	Reservations Reader	Reservations provider scope	Reserved Instance inventory, coverage, utilization, expiry, and recommendations
Reservations Contributor	Reservations Contributor	Reservations provider scope	Reservation refund quote calculation and reservation management workflows
Savings plan Reader	Savings plan Reader	Savings plans provider scope	Savings Plan inventory, coverage, utilization, expiry, and missed savings
Microsoft Graph governance permissions	Application.Read.All, RoleAssignmentSchedule.Read.Directory, RoleEligibilitySchedule.Read.Directory, RoleManagement.Read.Directory, GroupMember.Read.All, User.Read.All, and AuditLog.Read.All application permissions	Microsoft Graph application permission with admin consent	App registration, service principal, Global Admin/PIM, group membership, user, and audit diagnostics
Log Analytics Reader	Log Analytics Reader	Subscription, workspace, or inherited scope	Log Analytics queries, Application Insights evidence, and reliability diagnostics
Advisor suppression custom role	Custom role with Advisor suppression actions	Subscription	Sync dismissed or restored recommendations back to Azure Advisor
Storage inventory policy custom role	Custom role with storage inventory policy read/write actions	Selected storage account	Automated blob inventory policy configuration

Assign Cost Management Reader

This role lets Spotto read Azure Cost Management and Consumption data where API-based billing reads are used.

1. Open the affected subscription.
2. Open Access Control (IAM).
3. Select Add -> Add role assignment.
4. Select Cost Management Reader.
5. Assign it to the Spotto service principal.
6. Confirm the same service principal also has Reader on the subscription.

Cost Management Reader is not a substitute for billing exports. If your cloud account is configured to use exported billing data, also complete Cost Management export setup.

If a Cost Management export is created at billing scope instead of subscription scope, assign Spotto read access at that billing scope as well. Use Cost Management Reader for Azure RBAC cost scopes, the matching MCA billing reader role for Microsoft Customer Agreement scopes, or the equivalent EA read role for Enterprise Agreement scopes.

GDAP Permissions For MSP Customer Accounts

For GDAP cloud accounts, Spotto needs two access layers:

• A ready Spotto partner authorization profile in the MSP root company.
• Customer access through an active Microsoft Partner Center GDAP relationship and any required Azure RBAC or billing visibility.

Check these items when a GDAP scan reports missing access:

1. The customer approved the GDAP relationship in Microsoft 365 admin center.
2. The GDAP relationship is still active and has not expired or been terminated.
3. The partner security group has been added to the relationship.
4. The required Microsoft Entra roles have been assigned to that security group.
5. The Spotto partner profile has been authorized in the same Spotto region as the customer cloud account.
6. The customer tenant has granted the required Spotto application consent for the GDAP pilot flow.
7. The customer subscriptions are visible through delegated access or direct Azure RBAC.
8. CSP Azure Usage visibility is enabled when the customer uses CSP billing and Spotto needs cost data.

GDAP does not automatically grant every Azure subscription permission. If subscription or billing warnings remain after the relationship is active, resolve the specific Azure RBAC, Cost Management, or billing warning shown in Spotto. GDAP billing export setup is not supported yet; use the service principal setup paths when Cost Management exports are required.

Billing Prerequisites For CSP / Azure Plan Subscriptions

If your Azure subscriptions are provided through a CSP partner and billed under Microsoft Azure Plan or Microsoft Customer Agreement, billing features can depend on Azure Cost Management visibility in addition to subscription Reader access.

Before expecting billing-driven features such as Cost Analysis, Cost Tree, or dashboard spend widgets to populate, confirm all of the following:

1. The subscription is on Microsoft Azure Plan or Microsoft Customer Agreement, not the older classic CSP offer.
2. Your CSP partner has enabled customer cost visibility in the partner tenant:
   • Open Cost Management + Billing.
   • Select the billing account.
   • Open Customers and choose your customer.
   • Open Policies.
   • Set Azure Usage to Yes.
3. The Spotto service principal has Reader access on the relevant subscriptions or inherited scope.

caution

Spotto onboarding, PowerShell, Terraform, and manual Azure RBAC assignments cannot enable the partner-side billing policy. If Azure Usage cost visibility is off, credential validation can still succeed while billing-driven features remain empty or denied.

Assign Security Reader

This role lets Spotto read Defender for Cloud assessments and secure score data.

1. Open the affected subscription.
2. Open Access Control (IAM).
3. Select Add -> Add role assignment.
4. Select Security Reader.
5. Assign it to the Spotto service principal.
6. Confirm the same service principal also has Reader on the subscription.

Advisor Suppression Custom Role

This is optional write automation for syncing dismissed or restored recommendations back to Azure Advisor.

Use Azure Advisor write permissions for the required actions and assignment flow.

Storage Inventory Policy Custom Role

Storage Inventory analysis is reader-only in the current phase, and Spotto does not create or update Blob Inventory policies from this workflow.

If write-based provisioning is enabled later, use Azure Blob Inventory: Storage Inventory Access Model.

How To Fix A Warning

1. Open the warning in Spotto.
2. Note the missing permission, assignment scope, tenant, and subscription.
3. In Azure, Partner Center, or Microsoft 365 admin center, assign the listed role, Graph application permission, GDAP access assignment, or billing visibility.
4. Wait 5-10 minutes for Azure RBAC or Microsoft Graph consent propagation.
5. Return to Spotto and run tenant or subscription sync again.