Azure Cloud Account Setup Troubleshooting

Use this page when Azure credential validation succeeds but Spotto data is incomplete, or when validation fails after manual, PowerShell, Terraform, or automatic setup.

For selected GDAP pilots through Partner Center, use this page for failed authorization, missing subscriptions, billing gaps, or stopped scans after Spotto has enabled the GDAP workflow for the MSP and customer company.

Find The Failing GDAP Layer First

GDAP access is three separate grants, and Spotto checks them in a fixed order. Read the validation results top down and fix only the first blocked check — later checks often fail simply because an earlier one did.

Order	Check shown in Spotto	Layer	Fix
1	Partner authorization	A	Reauthorize the partner profile.
2	GDAP relationship	A	Confirm the relationship is active and belongs to this customer tenant in Partner Center.
3	Access assignment	A	Confirm the partner security group is assigned to the relationship and the assignment is active.
4	Application consent	A	Grant the Spotto consent in the customer tenant.
5	Subscription discovery	B	No readable subscriptions. Almost always the missing Admin Agents nesting.
6	Resource Graph and Resource inventory	B	Confirm Reader access on the subscriptions and wait for propagation.
7	Cost read	B	Degrades only. Assign Cost Management Reader on the subscriptions.
8	Partner Billing Cost Read	C	Degrades only. Turn on CSP Azure Usage visibility.

Checks 1 to 6 block the account. Checks 7 and 8 show Degraded: the account still scans, but cost data is incomplete.

The three layers are explained in How Azure Access Actually Works.

GDAP Relationship Is Blocked Immediately

If the form shows GDAP relationship as Blocked before it reaches the access-assignment check, confirm that the values are identifiers rather than display names.

• A relationship name such as parallo_gdap_dr_2024-08 is not a relationship ID.
• A group name such as CPM Admins is not a security-group Object ID.
• Customer tenant and security-group Object IDs are 36-character GUIDs.
• Microsoft current relationship examples look like two GUIDs joined by a hyphen, for example 5d027261-d21f-4aa9-b7db-7fa1f56fb163-8777b240-c6f0-4469-9e98-a3205431b836.

Fix:

1. Use Microsoft Graph PowerShell in the partner tenant to list relationships: Get-MgTenantRelationshipDelegatedAdminRelationship | Select-Object Id, DisplayName, Status.
2. Match the approved relationship and copy its Id, not DisplayName.
3. In Microsoft Entra admin center, open Entra ID -> Groups -> All groups, select the assigned partner group, open Properties, and copy Object ID.
4. Confirm the customer tenant ID belongs to the customer named by the relationship.
5. Return to Spotto and select Validate GDAP Access again.

If Spotto says partner authorization cannot read the relationship, reauthorize the partner profile in the MSP root company. If it reports a temporary Microsoft failure, wait briefly and validate again.

Full examples and retrieval instructions are in Copy IDs, Not Display Names.

note

Validation checks access only. It does not add an item to Cloud Accounts. After validation is Ready, select subscriptions and choose Save and Start Scan to persist the account under the currently selected Spotto company.

Credential Validation Fails

Likely causes:

• Application client ID or tenant ID was copied from the wrong app or tenant.
• The client secret value was copied incorrectly.
• The client secret expired.
• Reader access has not propagated yet.

Fix:

1. Re-check the Application (client) ID and Directory (tenant) ID from the same app registration.
2. Create a new client secret if needed and copy the secret value immediately.
3. Confirm the Spotto service principal has Reader at the subscription or inherited scope.
4. Wait 5-10 minutes for Azure RBAC propagation.
5. Validate again in Spotto.

Existing Service Principal Needs Replacement

Likely causes:

• The previous app registration or service principal was blocked or disabled.
• A new service principal exists, but Spotto is still using old credentials.

Fix:

1. In Spotto, go to Connectors -> Connectors -> Cloud Accounts.
2. Edit the affected Azure cloud account.
3. Replace the Tenant ID, Client ID, Client Secret Value, and Secret Expires At values.
4. Select Validate Connection.
5. Select Update to save.

Service-Principal Credential Is Expiring Or Expired

What you're seeing: Update Access recommends service-principal credential renewal, or Spotto reports that an expired credential blocks scanning.

Likely cause: The credential stored for the existing Azure cloud account expires within 90 days, has expired, or no expiry is recorded.

Fix:

1. Open the affected Azure cloud account and select Update Access or Repair Setup.
2. Sign in with an Entra administrator who can update credentials on the existing Spotto application.
3. Review Service-principal credential renewal. Renewal is preselected within 90 days, required after expiry, and optional when the expiry is farther away or unknown.
4. Run the update. Spotto reuses the existing app registration, service principal, and cloud account; do not create a replacement identity.
5. Confirm the new expiry shown by Spotto. The accepted duration can be 24, 12, or 6 months depending on tenant policy.

Spotto validates the replacement before switching its stored credential and leaves the previous Azure password in place. If optional renewal fails, the previous stored credential remains authoritative until it expires.

Automatic Setup Is Queued Or Retrying

What you're seeing: The page shows Azure Setup Queued, Running Setup, or Retrying Azure Setup for several minutes.

Likely cause: Azure provisioning, permission propagation, or throttling is taking longer than one request. A retry does not mean Spotto has restarted the whole setup.

Fix:

1. Keep the current setup link. You can close the page and return later; work continues in the background.
2. If Spotto shows a next retry time, wait until that time before intervening.
3. Select Refresh Status when it is offered.
4. Do not create another app registration or cloud account while the saved setup is active.
5. If the page changes to Needs Attention or Setup Failed, use the failed step, Azure message, scope, error code, and setup ID shown on the page to correct the exact issue.

If you select Request Cancellation, Spotto stops at the next safe checkpoint. A cloud account and credential already saved remain in place and can be repaired later.

GDAP Authorization Fails Or Returns To Spotto With An Error

Likely causes:

• The selected partner profile was authorized with the wrong partner tenant.
• The person signing in is not an administrator and cannot complete the Microsoft consent.
• The signed-in partner user cannot use the customer GDAP relationship.
• Microsoft consent was cancelled or blocked by tenant policy.
• The Spotto region callback URL does not match the region where the profile is being authorized.

Fix:

1. Switch to the MSP root company in Spotto.
2. Open Connectors -> Connectors -> Cloud Accounts.
3. Select the GDAP setup path.
4. Select the affected partner profile.
5. Confirm the partner tenant ID is correct.
6. Select Authorize Profile again and complete Microsoft sign-in.
7. Return to the customer company and retry Check details.

If the blocker is that nobody available is a Global Administrator, select Create approval link instead and send the link to one. They approve with their own Microsoft account and need no Spotto login. See Hand The Approval To A Global Administrator.

Customer Application Consent Is Blocked

Spotto shows Customer application consent is missing and the Application consent check is Blocked.

Likely causes:

• The Spotto application has never been approved inside that customer's tenant.
• Your partner admin tried to grant it, but the relationship does not include Cloud Application Administrator or Application Administrator.
• Your partner admin is not in the assigned GDAP security group, or that group is not under Admin Agents.

Fix, whichever is easier:

1. In the blocked Application consent result, select Create customer approval link.
2. Send that link to a Global Administrator in the customer's tenant. They approve in their own tenant with no Spotto login, and this works even when your relationship has no application administration role.
3. Ask them to confirm that the tenant displayed by Spotto and Microsoft is the intended customer tenant before approving.
4. Or grant it yourself through Partner Center, after confirming your partner user is in the assigned security group, that group is under Admin Agents, and the relationship includes Cloud Application Administrator or Application Administrator.

Then return to Spotto and select Validate GDAP Access again. If your version of Spotto still shows a consent confirmation checkbox, checking it does not grant Microsoft consent; live validation is the authoritative check.

caution

If the relationship does not include an application administration role, it cannot be added. Roles cannot be added to an approved GDAP relationship. Use the approval link instead, or request a new relationship.

GDAP Validation Finds No Readable Subscriptions

Spotto shows No readable subscriptions, or Subscription discovery is Blocked, while the relationship and access assignment look healthy.

This is the most common first-run failure, and no Microsoft Entra role fixes it. Delegated Entra roles grant zero Azure permissions. This is a Layer B problem.

Likely causes:

• CSP / Azure Plan: the security group assigned to the relationship is not nested under Admin Agents in the partner tenant.
• CSP / Azure Plan: the partner user who authorized the Spotto profile is not a member of the assigned security group.
• EA or MCA-direct: the customer has not assigned Azure RBAC to the partner security group.
• Azure role assignments or group membership have not propagated yet.

Fix:

1. Identify how the customer's Azure is billed. CSP/Azure Plan uses group nesting; EA and MCA-direct use direct Azure RBAC.
2. For CSP/Azure Plan, add the assigned security group as a member of Admin Agents in your partner tenant.
3. Confirm the authorizing partner user is a member of the assigned security group.
4. For EA and MCA-direct, ask the customer to assign at least Reader to the partner security group on the subscriptions or a covering management group.
5. Wait 5-10 minutes for group membership and Azure RBAC propagation.
6. Select Validate GDAP Access again.

Full steps and the recommended role set are in Layer B: Give Spotto Access To Azure Subscriptions.

GDAP Customer Account Saves But First Scan Fails

Likely causes:

• The GDAP relationship ID belongs to a different customer tenant.
• The GDAP relationship is approved but no partner security group has been assigned.
• The access assignment exists but is still pending.
• The assigned security group is not nested under Admin Agents, so no Azure subscriptions are readable.
• Azure subscription access is not available through delegated access or Azure RBAC.
• CSP Azure Usage visibility is disabled for the customer.

Fix:

1. In Partner Center, confirm the customer, tenant ID, relationship ID, and relationship status.
2. Confirm the partner security group is assigned to the relationship and the status is active.
3. Confirm the roles assigned to the security group match the agreed customer scope.
4. Confirm Layer B is complete, so the delegated access path can see the customer's Azure subscriptions.
5. For GDAP billing data, review CSP Billing Prerequisites. GDAP billing export creation is not supported; use the service principal setup paths when Cost Management exports are required.
6. Return to Spotto and run the scan again.

GDAP Daily Scans Stopped

Likely causes:

• The customer terminated the GDAP relationship.
• The relationship expired.
• The partner security group assignment was removed.
• Microsoft revoked the refresh token or the partner profile needs reauthorization.

Fix:

1. Confirm the relationship is still active in Partner Center.
2. Confirm the access assignment is still active.
3. Reauthorize the Spotto partner profile from the MSP root company.
4. Run the customer cloud account scan again.

Monitoring Or Log-Backed Data Is Missing

Likely causes:

• Monitoring Reader has not been assigned.
• Log Analytics Reader has not been assigned.
• Azure role assignments have not propagated.

Fix:

1. Assign Monitoring Reader on relevant subscriptions.
2. Assign Log Analytics Reader on relevant subscriptions, workspaces, or the root management group.
3. Wait 5-10 minutes.
4. Refresh the affected Spotto view or run sync again.

Key Vault Expiry Dates Or Notifications Are Missing

Likely causes:

• Key Vault Reader is missing at the subscription or an inherited scope.
• The vault uses the legacy access-policy permission model instead of Azure RBAC.
• A Key Vault firewall or private endpoint blocks Spotto's metadata requests.
• The secret, key, or certificate has no expiry date set.

Fix:

1. For an Azure RBAC vault, assign Key Vault Reader at a covering management group, subscription, resource group, or vault scope.
2. For a legacy access-policy vault, grant only List for keys, secrets, and certificates to the Spotto service principal on that vault.
3. Confirm the vault network configuration allows Spotto to reach the Key Vault data plane.
4. Wait 5-10 minutes for access propagation, then run sync again.

Retirement Tracker includes only enabled base objects with an explicit expiry date. It does not enumerate historical versions. A partial-coverage warning identifies an access, network, or throttling gap; Spotto retains existing Key Vault alerts until a complete scan confirms that an item is gone.

See Assign Key Vault Reader for the exact role and least-privilege guidance.

Billing Data Is Missing Or Incomplete

Likely causes:

• One or more subscriptions are not covered by an applicable subscription, management-group, or billing-scope export.
• The exports are not daily actual/amortized cost exports.
• Spotto does not have Storage Blob Data Reader on the export container.
• The storage account network settings block Azure Cost Management export writes or Spotto's authenticated reads.
• Spotto can read the subscription but cannot read the export definition or run history at its exact management-group or billing scope.
• CSP Azure Usage visibility is disabled by the partner.
• Azure Cost Management has not generated export files yet.

Fix:

1. Confirm billing export coverage for every intended subscription. A broad management-group or billing-scope export can cover multiple subscriptions.
2. Confirm Spotto has read access to the exact subscription, management-group, or billing scope that owns the export definition and run history.
3. Confirm the export container is private and reachable by the Azure Cost Management export job.
4. Confirm the Spotto service principal has Storage Blob Data Reader and a reachable network path to the container.
5. For CSP subscriptions, confirm CSP Billing Prerequisites.
6. Wait for the next export run or manually run the export in Azure where supported.
7. Run Spotto sync again.

Spotto normally uses Azure billing APIs for the newest interval after the latest complete export and for other uncovered dates. If exports remain unavailable, confirm Cost Management Reader and subscription Reader access so API fallback can continue where the Azure agreement supports it.

Governance Or Commitment Data Is Missing

Likely causes:

• Management Group Reader is missing at the root management group.
• Reservations Reader is missing.
• Reservations Contributor is missing for reservation refund quote or management workflows.
• Savings plan Reader is missing.
• One or more Microsoft Graph governance application permissions are missing, including Policy.Read.All or LicenseAssignment.Read.All.
• Tenant admin consent has not been granted for every configured Graph permission.

Fix:

1. Review the permission warning matrix.
2. Assign the missing Azure role or add the complete Graph governance application-permission set, then grant tenant admin consent.
3. Wait 5-15 minutes.
4. Run tenant sync again.

If Spotto reports that the tenant needs Microsoft Entra ID P2 or Microsoft Entra ID Governance for PIM schedules, that is a licensing limitation rather than a missing Graph permission. Active non-PIM role assignments can still be collected; eligible PIM assignments are not applicable until the tenant has a supporting license.

Azure Policy Exemption Is Forbidden Or Stays Pending

Likely causes:

• Microsoft.Authorization/policyExemptions/write is missing at the target scope.
• Microsoft.Authorization/policyAssignments/exempt/action is missing at the assignment scope.
• The initiative is inherited and the action exists only on the child subscription, not its management group.
• Azure RBAC or Azure Policy evaluation has not propagated yet.

Fix:

1. Open the assignment detail in Regulatory Compliance and note the target and assignment scopes separately.
2. Follow Azure Policy exemption write permissions.
3. Wait for Azure RBAC propagation and retry the retained request.
4. If the Azure action completed, run sync and wait for Azure-derived exemption/evaluation evidence rather than creating a second request.

Automatic Setup Completed With Warnings

Automatic setup can save the cloud account and return a partial result when recommended items such as root-management-group access, Key Vault Reader, billing exports, commitments, or Graph consent still need attention. Only subscriptions whose own Reader access was verified are released for sync.

Fix:

1. Open the Azure cloud account in Spotto.
2. Review sync diagnostics and setup warnings.
3. Select Repair Setup or Update Access under the account's Azure access section.
4. Run automatic update again, or use the relevant manual permission steps.