Skip to main content

Write Permissions Setup: Separate vs Shared

Overview​

Write permissions are additive. Your Azure cloud account still needs the baseline read permissions from Azure Cloud Account Setup. Reservations Contributor stays optional and is only needed for reservation refund quotes and reservation management.

Credential Configuration Options​

Write-back can reuse the read app or use its own app registration. Separate credentials are recommended for production.

Same credentials: one Spotto Read app with one client ID and secret holds the Reader and read roles plus the custom write role, and is used for both scans and write-back; one secret to rotate, but if it leaks it can read and write. Separate credentials: the Spotto Read app holds the read roles and is used for scans; a Spotto Write app with its own client ID, secret and expiry date in the same tenant holds only the custom write role and is used for write-back, so it can be rotated or removed without touching scans. Write access, separate credentials and every write feature start off, and Spotto generates the custom role JSON for just the write features you tick.Same credentials: one Spotto Read app with one client ID and secret holds the Reader and read roles plus the custom write role, and is used for both scans and write-back; one secret to rotate, but if it leaks it can read and write. Separate credentials: the Spotto Read app holds the read roles and is used for scans; a Spotto Write app with its own client ID, secret and expiry date in the same tenant holds only the custom write role and is used for write-back, so it can be rotated or removed without touching scans. Write access, separate credentials and every write feature start off, and Spotto generates the custom role JSON for just the write features you tick.

With separate credentials, keep tenant-wide governance, reservation provider and Microsoft Graph permissions on the read app. Give the write app only the Azure RBAC actions for the write features you enable.

Steps to Enable Write Permissions​

  1. Go to Connectors -> Cloud Accounts in the Spotto Portal.
  2. Select your Azure cloud account or create a new one, and configure the read access credentials if needed.
  3. In Write Permissions Configuration, turn on Enable write access.
  4. For separate credentials, also turn on Use separate credentials for write operations and enter the Write Access Client ID, Write Access Client Secret Value and Secret Expiration Date. The tenant ID is shared with the read credentials.
  5. Under Write Permissions, tick the features you want:
    • Dismiss Azure Advisor Recommendations
    • Enable Storage Inventory Reports (inventory analysis is reader-only today; see Storage Inventory)
    • Create Azure Policy Exemptions (see Policy Exemptions for the management-group role)
  6. Expand Custom Role for Least Privilege, copy the JSON, and create and assign the role in Azure. See Custom Roles.
  7. Select Validate Connection, then Update to save.

Validate Connection signs in with the write credential and reports how many subscriptions it can see. It does not check the custom role's actions. Azure checks those when Spotto first acts, for example when you dismiss a recommendation.

Turning off Enable write access and saving removes the stored write client ID, secret and expiry date. You need to enter them again to turn write access back on.

Create a Separate Write App​

1. Create an Entra ID Application​

  1. Go to the Azure Portal and sign in.
  2. Open Microsoft Entra ID > Manage > App registrations > New registration.
  3. Enter a name, e.g. Spotto Write.
  4. Under Supported account types, choose Accounts in this organizational directory only.
  5. Leave the Redirect URI blank, then select Register.

Record the Application (client) ID and Directory (tenant) ID.

2. Create a Client Secret​

  1. In the app registration, go to Manage > Certificates & secrets.
  2. Under Client secrets, select New client secret.
  3. Enter a description (e.g. SpottoWriteSecret) and choose an expiry period (recommended: 12 months).
  4. Select Add.
info

Copy the Client Secret Value immediately. It won't be shown again. Also record its expiry date.

3. Assign Required Roles​

Assign the custom role for the features you ticked to the write app:

If validation or a write action fails, see Troubleshooting. For rotation and revocation, see Security Best Practices.

For further assistance, please Contact Us.