Skip to main content

Azure Write Permissions: Automate Actions Safely

Overview​

Spotto reads your Azure environment by default. Write permissions let actions you take in Spotto reach Azure. Each one is optional, uses its own custom role with only the actions it needs, and stays off until you turn it on. You can remove it at any time.

Optional write-back. Dismissing a recommendation uses an Advisor suppression role on the subscription and also dismisses it in Azure Advisor. Scheduling a VM uses start and deallocate on that VM only. Scheduling Azure Bastion uses delete and recreate on its resource group, so there are no Bastion charges outside your access windows. Exempting a policy uses policy exemption write on the subscription and policy assignment, and the exemption and reason appear in Azure Policy. Quoting a reservation refund uses Reservations Contributor and changes nothing.Optional write-back. Dismissing a recommendation uses an Advisor suppression role on the subscription and also dismisses it in Azure Advisor. Scheduling a VM uses start and deallocate on that VM only. Scheduling Azure Bastion uses delete and recreate on its resource group, so there are no Bastion charges outside your access windows. Exempting a policy uses policy exemption write on the subscription and policy assignment, and the exemption and reason appear in Azure Policy. Quoting a reservation refund uses Reservations Contributor and changes nothing.

On the cloud account you choose Dismiss Azure Advisor Recommendations, Enable Storage Inventory Reports and Create Azure Policy Exemptions. Storage inventory analysis is reader-only today (see the access model). VM and Bastion schedule roles are approved when you activate a schedule; see Azure permissions. Remediation actions on recommendations also run with the write credential when one is set.

Spotto keeps working with read-only access if you prefer to make every change in Azure yourself.

Prerequisites​

  1. An Azure cloud account registered in Spotto.
  2. Owner or User Access Administrator in Azure, so you can create custom roles and assign them.
  3. A choice between the same credentials or a separate write credential. See Configuration.

Next Steps​

For further assistance, please Contact Us.