Skip to main content

Azure Setup With PowerShell Script

Use the PowerShell path when your Azure admin team prefers a local guided script.

The script is idempotent, so it can be rerun to repair interrupted setup, add missing permissions, or update recommended access.

Before running the script, confirm the Azure admin has the required temporary setup privileges. If your organization uses PIM or just-in-time access, see Operator Permissions And PIM.

For full automation, activate Owner at the selected subscription or inherited parent scope. If Owner is not available, activate both Contributor and User Access Administrator. User Access Administrator alone can assign RBAC roles, but it cannot create Cost Management exports, resource groups, storage accounts, or containers.

What The Script Configures​

Setup-SpottoAzure.ps1 can configure:

  • A Spotto Entra ID app registration and service principal, reusing an existing Spotto app where present.
  • A client secret for Spotto.
  • Reader access on selected subscriptions, or tenant root Reader access when onboarding all subscriptions.
  • Reader and Management Group Reader at the root management group.
  • Reservations Reader, Reservations Contributor, and Savings plan Reader.
  • Microsoft Graph governance permissions with admin consent.
  • Optional Monitoring Reader and Log Analytics Reader.
  • Cost Management exports to customer-owned Azure Storage.
  • Cost Management Reader on linked billing scopes when compatible billing-scope exports are discovered and the scope is available.
  • Storage Blob Data Reader on the billing export container.
  • Optional custom write access for supported Spotto actions.

Run The Script​

  1. Open the Spotto Azure onboarding script repository: Spotto Azure onboarding tools.
  2. Review the script and prerequisites with your Azure admin team.
  3. Run Setup-SpottoAzure.ps1 from a PowerShell session.
  4. Follow the prompts for tenant, subscription, monitoring, Graph, and billing export setup.
  5. Record the generated values:
    • Directory (tenant) ID
    • Application (client) ID
    • Client secret value
    • Secret expiry date
  6. Add Or Update the Azure account in Spotto using these Spotto Portal steps.

Billing Exports​

The script treats Cost Management exports as highly recommended. When enabled, it can:

  • Detect compatible existing daily exports and reuse them.
  • Detect compatible billing-scope exports where the signed-in operator has access, and grant Spotto read access at the linked billing scope when available.
  • Create or select customer-owned export storage.
  • Ensure a private container, defaulting to spotto-cost-exports.
  • Grant Storage Blob Data Reader on the export container.
  • Create daily actual and amortized Cost Management exports where supported.
  • Queue historical backfill for recent closed months.

The script queues export runs and backfill requests with Azure, but it does not wait for Azure Cost Management to finish generating export files. Billing files can appear later depending on Azure export timing.

If your organization skips billing export setup in the script, Spotto can still validate basic Azure access, but billing-driven views can be delayed or incomplete. If you reuse a billing-scope export, make sure Spotto also has reader access at that billing scope and network access to the export storage account.

Billing export setup needs resource-management permission as well as role-assignment permission. Use Owner for the simplest PIM activation, or Contributor plus User Access Administrator if your organization separates resource changes from RBAC assignment.

When To Use Another Path​

Use Automatic Azure Connect if your admin can complete setup directly from Spotto.

Use Terraform Module if your organization wants the app registration, role assignments, and billing export resources managed as infrastructure as code.