Azure Cloud Account Permission Required Warnings
Fix this error
Spotto shows Azure cloud account Permission required warnings when a tenant or subscription sync step cannot collect a dataset because required Azure access is missing.
Use the warning text shown in the portal to find the Azure role, consent, or billing policy that needs to be added.
Find the missing permission in Spotto
- Open Connectors -> Connectors -> Cloud Accounts.
- Open the affected Azure cloud account.
- Open Sync diagnostics.
- Select the affected tenant or subscription row.
- In Sync Step Details, find the warning in the Detail column. It looks like
<permission name> required. - Hover or open the info icon and note the Missing permission and Assign at fields.
Fix the warning in Azure
These are the same warning labels and tooltip fields shown in the front end.
| What Spotto shows | Missing permission in tooltip | Assign at | What to fix | What is affected |
|---|---|---|---|---|
| Resource Groups Reader required | Reader | Subscription or inherited management group | Assign Reader to the Spotto app. | Resource grouping and subscription inventory context |
| Resource Inventory Reader required | Reader | Subscription or inherited management group | Assign Reader to the Spotto app. | Resource inventory, recommendations, relationship graphs, and resource views |
| Activity Log Reader required | Reader | Subscription | Assign Reader to the Spotto app on the subscription. | Activity-aware refresh, operational context, and cost-impacting change detection |
| Resource Graph Reader required | Reader | Subscription or inherited management group | Assign Reader to the Spotto app. | Resource Graph queries used by recommendations, governance, reliability, and security checks |
| Cost Management Reader required | Cost Management Reader + Reader | Subscription | Assign Cost Management Reader and confirm Reader. | Cost trends, budgets, savings calculations, and cost overlays |
| Consumption Usage Reader required | Cost Management Reader + Reader | Subscription | Assign Cost Management Reader and confirm Reader. | Usage attribution, commitment analysis, and cost decomposition |
| Billing export storage access required | Storage Blob Data Reader + active Cost Management exports | Export storage container or storage account, plus subscription export scope | Configure Cost Management exports and assign Storage Blob Data Reader to the Spotto app on the export container or storage account. | Cost Analysis, Cost Tree, dashboard spend widgets, and billing history ingestion |
| Azure Cost Management visibility required | CSP Azure Usage visibility + Reader | CSP partner billing account customer policy and subscription | Ask the CSP partner to enable Azure Usage for the customer and confirm Spotto has Reader. | Cost Analysis, Cost Tree, dashboard spend widgets, and billing overlays |
| Monitoring Reader required | Monitoring Reader | Subscription or monitored resource scope | Assign Monitoring Reader. | Azure Monitor metrics, rightsizing, performance evidence, alerts, and diagnostics |
| Log Analytics Data Reader required | Log Analytics Reader | Subscription or Log Analytics workspace | Assign Log Analytics Reader at the subscription, workspace, or inherited scope. | Log Analytics queries, Application Insights evidence, and reliability diagnostics |
| Security Reader required | Security Reader + Reader | Subscription | Assign Security Reader and confirm Reader. | Defender for Cloud assessments, secure score, and security posture summaries |
| Advisor Recommendations Reader required | Reader | Subscription | Assign Reader to the Spotto app. | Azure Advisor recommendation import and optimization workflows |
| Management Group Reader required | Management Group Reader | Root management group | Assign Management Group Reader at the tenant root or root management group. | Management group hierarchy and tenant-level governance context |
| Reservations Reader required | Reservations Reader | Reservations provider scope | Assign Reservations Reader from the Azure Reservations area. | Reserved Instance inventory, coverage, utilization, and commitment opportunities |
| Reservations Contributor required | Reservations Contributor | Reservations provider scope | Assign Reservations Contributor from the Azure Reservations area. | Reservation refund quote calculation and reservation management workflows |
| Savings Plan Reader required | Savings plan Reader | Savings plans provider scope | Assign Savings plan Reader from the Azure Savings plans area. | Savings Plan inventory, coverage, utilization, and missed savings |
| Graph governance permissions required | Microsoft Graph governance permissions | Microsoft Graph application permission with admin consent | Add the Spotto Graph governance application permissions and grant admin consent. | Application registration, service principal, Global Admin/PIM, group membership, user, and audit diagnostics |
Some cloud account form warnings are not subscription sync steps, but they use the same Missing permission pattern:
| What Spotto shows | Missing permission in tooltip | Assign at | What to fix |
|---|---|---|---|
| Advisor suppressions required | Custom role with Advisor suppression actions | Subscription | Assign a custom role with the Advisor suppression actions documented in the write-permissions guide. |
| Storage inventory write required | Custom role with storage inventory policy read/write actions | Selected storage account | Assign the storage inventory policy read/write custom role if that automation is enabled. |
Retry the affected sync
After the Azure change:
- Wait 5-15 minutes for Azure RBAC or Microsoft Graph consent to propagate.
- Return to the affected Azure cloud account in Spotto.
- Rerun the tenant sync or subscription sync.
- Reopen Sync diagnostics and confirm the warning is gone.
What this error means
Error type: capabilityMissing
The Azure account can authenticate, but a specific dataset is unavailable. Spotto keeps the rest of the sync moving where it can and marks the affected tenant or subscription step with the missing permission.
This is why credential validation can succeed while one feature still looks empty. Authentication worked. The narrower read path did not.
Why it happens
Azure uses different access models for different data sources:
- Subscription inventory, resource groups, Activity Log, Resource Graph, and Advisor data usually depend on subscription Reader.
- Billing data depends on Cost Management Reader, Reader, Cost Management exports to customer-owned storage, Storage Blob Data Reader on the export container or storage account, and sometimes CSP partner-side Azure Usage visibility.
- Management group governance depends on root management group access.
- Reservations and Savings Plans use provider-scope roles. Reservation refund quote and management workflows need Reservations Contributor, not just Reservations Reader.
- Microsoft Graph application, service principal, Global Admin/PIM, group membership, user, and audit data require Graph application permissions and admin consent.
- Monitoring and Log Analytics data can require roles at subscription, workspace, or monitored-resource scope.
Who can fix it
The person who can fix the warning depends on the missing permission. In Spotto, the warning tooltip shows Assign at to identify the Azure scope. If the scope is outside your access, send this page to the Azure owner for that scope.
For CSP billing visibility, the customer tenant administrator may not be able to fix the partner policy. The CSP partner or billing administrator must enable Azure Usage visibility.
For Enterprise Agreement billing visibility, an Enterprise Administrator must enable Account owners can view charges (AO view charges). Subscription RBAC cannot override that enrollment policy.
Important notes
- Spotto onboarding scripts and Terraform can assign Azure RBAC, but they cannot enable CSP partner-side billing visibility.
- Billing export setup has two sides: Azure must write Cost Management exports to storage, and the Spotto service principal must be able to read those blobs with Storage Blob Data Reader. If the export is at billing scope, Spotto also needs read access at that billing scope to discover it.
- Azure RBAC, management group permissions, and Microsoft Graph admin consent can take several minutes to propagate.
- If the warning remains after the permission is granted, confirm the role was assigned to the same app registration/client ID configured in Spotto.
- If multiple subscriptions show the same warning, check whether the role should be assigned at an inherited management group scope instead of one subscription at a time.