Azure Cloud Account Permission Required Warnings
Fix this error
Spotto shows Azure cloud account Permission required warnings when Azure has confirmed that required access is missing. Not confirmed and Optional results do not prove a permission is missing.
Use the warning text shown in the portal to find the Azure role, consent, or billing policy that needs to be added.
Find the missing permission in Spotto
- Open Connectors -> Connectors -> Cloud Accounts.
- Open the affected Azure cloud account.
- Open Sync diagnostics.
- Select the affected tenant or subscription row.
- In Sync Step Details, find the result in the Detail column.
- If it says
<permission name> required, open the info icon and note the Missing permission and Assign at fields. - If it says Not confirmed, retry validation before changing Azure roles.
- If it says Optional, no action is required for standard read-only onboarding.
Fix the warning in Azure
These are the same warning labels and tooltip fields shown in the front end.
| What Spotto shows | Missing permission in tooltip | Assign at | What to fix | What is affected |
|---|---|---|---|---|
| Resource Groups Reader required | Reader | Subscription or inherited management group | Assign Reader to the Spotto app. | Resource grouping and subscription inventory context |
| Resource Inventory Reader required | Reader | Subscription or inherited management group | Assign Reader to the Spotto app. | Resource inventory, recommendations, relationship graphs, and resource views |
| Activity Log Reader required | Reader | Subscription | Assign Reader to the Spotto app on the subscription. | Activity-aware refresh, operational context, and cost-impacting change detection |
| Resource Graph Reader required | Reader | Subscription or inherited management group | Assign Reader to the Spotto app. | Resource Graph queries used by recommendations, governance, reliability, and security checks |
| Cost Management Reader required | Cost Management Reader + Reader | Subscription | Assign Cost Management Reader and confirm Reader. | Cost trends, budgets, savings calculations, and cost overlays |
| Consumption Usage Reader required | Cost Management Reader + Reader | Subscription | Assign Cost Management Reader and confirm Reader. | Usage attribution, commitment analysis, and cost decomposition |
| Azure Cost Management visibility required | CSP Azure Usage visibility + Reader | CSP partner billing account customer policy and subscription | Ask the CSP partner to enable Azure Usage for the customer and confirm Spotto has Reader. | Cost Analysis, Cost Tree, dashboard spend widgets, and billing overlays |
| Azure Monitor metrics access required | Monitoring Reader | Subscription or monitored resource scope | Assign Monitoring Reader. | Azure Monitor metrics, rightsizing, performance evidence, alerts, and diagnostics |
| Log Analytics Data Reader required | Log Analytics Reader | Subscription or Log Analytics workspace | Assign Log Analytics Reader at the subscription, workspace, or inherited scope. | Log Analytics queries, Application Insights evidence, and reliability diagnostics |
| Defender for Cloud assessments access required | Security Reader + Reader | Subscription | Assign Security Reader and confirm Reader. | Defender for Cloud assessments, secure score, and security posture summaries |
| Advisor Recommendations Reader required | Reader | Subscription | Assign Reader to the Spotto app. | Azure Advisor recommendation import and optimization workflows |
| Management Group Reader required | Management Group Reader | Root management group | Assign Management Group Reader at the exact root management group. | Management group hierarchy and tenant-level governance context |
| Reservations Reader required | Reservations Reader | Reservations provider scope | Assign Reservations Reader from the Azure Reservations area. | Reserved Instance inventory, coverage, utilization, and commitment opportunities |
| Reservations Contributor required | Reservations Contributor | Reservations provider scope | Assign Reservations Contributor from the Azure Reservations area. | Reservation refund quote calculation and reservation management workflows |
| Savings Plan Reader required | Savings plan Reader | Savings plans provider scope | Assign Savings plan Reader from the Azure Savings plans area. | Savings Plan inventory, coverage, utilization, and missed savings |
| Active directory role assignments access required | RoleAssignmentSchedule.Read.Directory | Microsoft Graph application permission with admin consent | Add the permission and grant tenant admin consent. If Azure returns AadPremiumLicenseRequired, no permission is missing; see the licensing note below. | Active Global Admin and privileged-role assignments |
| Eligible directory role assignments access required | RoleEligibilitySchedule.Read.Directory | Microsoft Graph application permission with admin consent | Add the permission and grant tenant admin consent. If Azure returns AadPremiumLicenseRequired, no permission is missing; see the licensing note below. | Eligible Global Admin and privileged-role assignments through PIM |
| Directory role definitions access required | RoleManagement.Read.Directory | Microsoft Graph application permission with admin consent | Add the permission and grant tenant admin consent. | Directory role definitions and role-management context |
| Graph governance permissions required | Microsoft Graph governance permissions | Microsoft Graph application permission with admin consent | Add the complete Spotto Graph governance application-permission set, including Policy.Read.All and LicenseAssignment.Read.All, and grant tenant admin consent. | Application registration, service principal, Global Admin/PIM, group membership, user, audit, tenant policy, licensing, and MFA posture diagnostics |
Handle optional billing export results
Optional subscription billing export, Optional tenant-level billing export, and Optional billing-account billing export report whether Spotto can use an existing Cost Management export. They do not block standard read-only onboarding and are not counted as missing permissions.
No action is required unless you want export-first billing ingestion. Locating an export definition and reading its files are separate checks: Spotto needs read access at the exact export scope, Storage Blob Data Reader on the destination, and a reachable storage network path. See Azure Billing Exports.
Retry checks that are not confirmed
Not confirmed means Azure or Microsoft Graph did not return a conclusive response. It does not mean the role shown for that capability is missing.
For example, Defender for Cloud assessments not confirmed with Azure did not respond before the validation timeout. Try validation again. is a timeout. Retry validation. Assign Security Reader only if a later result explicitly reports Missing or access required.
The same rule applies to Directory role definitions not confirmed. Retry validation before changing RoleManagement.Read.Directory consent.
Some cloud account form warnings are not subscription sync steps, but they use the same Missing permission pattern:
| What Spotto shows | Missing permission in tooltip | Assign at | What to fix |
|---|---|---|---|
| Advisor suppressions required | Custom role with Advisor suppression actions | Subscription | Assign a custom role with the Advisor suppression actions documented in the write-permissions guide. |
| Storage inventory write required | Custom role with storage inventory policy read/write actions | Selected storage account | Assign the storage inventory policy read/write custom role if that automation is enabled. |
| Azure Policy exemptions required | policyExemptions/write and policyAssignments/exempt/action | Exemption target and exact policy assignment scope | Follow the policy exemption permission guide; inherited initiatives need the assignment action at their management group. |
Retry validation or the affected sync
After the Azure change:
- Wait 5-15 minutes for Azure RBAC or Microsoft Graph consent to propagate.
- Return to the affected Azure cloud account in Spotto.
- Rerun account validation, the tenant sync, or the subscription sync that reported the result.
- Reopen Sync diagnostics and confirm the warning is gone.
What this error means
Error type: capabilityMissing
The Azure account can authenticate, but a specific dataset is unavailable. Spotto keeps the rest of the sync moving where it can and marks a confirmed authorization denial with the missing permission.
This is why credential validation can succeed while one feature still looks empty. Authentication worked. The narrower read path did not.
Why it happens
Azure uses different access models for different data sources:
- Subscription inventory, resource groups, Activity Log, Resource Graph, and Advisor data usually depend on subscription Reader.
- Core billing reads depend on Cost Management Reader, Reader, and sometimes CSP partner-side Azure Usage visibility. Cost Management exports and Storage Blob Data Reader are optional enhancements for export-first ingestion.
- Management group governance depends on root management group access.
- Reservations and Savings Plans use provider-scope roles. Reservation refund quote and management workflows need Reservations Contributor, not just Reservations Reader.
- Microsoft Graph application, service principal, Global Admin/PIM, group membership, user, audit, tenant policy, subscribed-license, and MFA posture data require the documented Graph application permissions and tenant admin consent.
- Monitoring and Log Analytics data can require roles at subscription, workspace, or monitored-resource scope.
These validation outcomes do not mean another role is missing:
- Microsoft Graph error
AadPremiumLicenseRequiredmeans PIM schedule data is unavailable because the tenant does not have Microsoft Entra ID P2 or Microsoft Entra ID Governance. Spotto marks that schedule check Not applicable. - Azure resources such as
microsoft.insights/actiongroupsdo not expose a platform metric namespace. Spotto skips them as metric-validation candidates instead of reporting a Monitoring Reader warning. - A client timeout or another Not confirmed response means the read was inconclusive. Retry validation before changing access.
- An Optional billing-export result describes an enhancement that is not configured or could not be confirmed. It does not reduce standard onboarding readiness.
Who can fix it
The person who can fix the warning depends on the missing permission. In Spotto, the warning tooltip shows Assign at to identify the Azure scope. If the scope is outside your access, send this page to the Azure owner for that scope.
For CSP billing visibility, the customer tenant administrator may not be able to fix the partner policy. The CSP partner or billing administrator must enable Azure Usage visibility.
For Enterprise Agreement billing visibility, an Enterprise Administrator must enable Account owners can view charges (AO view charges). Subscription RBAC cannot override that enrollment policy.
Important notes
- Spotto onboarding scripts and Terraform can assign Azure RBAC, but they cannot enable CSP partner-side billing visibility.
- Billing export setup is optional. If enabled, Azure must write Cost Management exports to storage and the Spotto service principal needs Storage Blob Data Reader. Billing-scope exports also need read access at that billing scope for discovery.
- Azure RBAC, management group permissions, and Microsoft Graph admin consent can take several minutes to propagate.
- If the warning remains after the permission is granted, confirm the role was assigned to the same app registration/client ID configured in Spotto.
- If multiple subscriptions show the same warning, check whether the role should be assigned at an inherited management group scope instead of one subscription at a time.