FOCUS exports and storage setup

Status

Live — optional lane · Last verified 27 July 2026

What you’ll need

• Role: rights to create a scheduled export in Cost Management, plus data-plane rights on the destination storage — Storage Blob Data Contributor, or access to the account keys if you use a SAS.
• Scope: one storage account container that you own and control.
• Time: around 30 minutes to configure, then up to 24 hours for Azure to deliver the first export.

Validated against the Azure portal on 27 July 2026.

The default onboarding path — the one described in connect Azure — reads spend through the Azure Cost Details API at daily granularity. It needs only two roles and no storage setup, and it is the right choice for almost every estate. If the Cost API lane already covers you, you do not need anything on this page.

When to consider it

Consider the FOCUS lane only if both of these are true.

• The daily Cost Details export becomes too slow to complete overnight. generateCostDetailsReport grows with the number of line items, and once it no longer completes inside the nightly window, a pre-materialised monthly export is cheaper to pull.
• A portable, standard dataset matters to you. FOCUS 1.2 is the FinOps Foundation’s open, vendor-neutral billing standard, produced natively by Azure, so your spend arrives in a shape that moves between tools without re-mapping.

Infralign configures the lane as a monthly export for scale and portability. Azure Cost Management exports support other cadences; this page documents the configuration Infralign uses.

Set up the export

These commands are bash

Run them in Azure Cloud Shell (Bash) or WSL. In PowerShell, replace the trailing \ line continuations with a backtick (`).

1. In Cost Management + Billing → Exports, create a scheduled export.
2. Choose the FOCUS 1.2 dataset (not the legacy actual/amortised cost dataset).
3. Deliver it to a dedicated storage account container you own and control.
4. Set the cadence to monthly and let the first export land. Azure typically delivers it within 24 hours.

# Create a dedicated container for the export (once)
az storage container create \
  --account-name <storage-account> \
  --name focus-exports \
  --auth-mode login

Create the export itself from the portal (or via the Cost Management REST API); the container above is the destination it writes to.

Grant access to the export

The platform pulls the parquet with azcopy from your container, and needs read and list on that container only. Pick one of the two grants below — Option A is preferred.

You need data-plane rights to run these

The identity running the commands below needs data-plane rights. Creating the container and assigning the storage role needs Storage Blob Data Contributor, or Owner plus a data-plane role. Generating an account-key SAS needs access to the account keys. A control-plane-only Owner returns AuthorizationPermissionMismatch on the data-plane calls.

Option A — Storage Blob Data Reader (identity-based, preferred). Assign the built-in Storage Blob Data Reader role to the infralign-reader service principal, scoped to the export container only — not the storage account, resource group, or subscription.

az role assignment create --assignee <appId> \
  --role "Storage Blob Data Reader" \
  --scope "/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<storage-account>/blobServices/default/containers/focus-exports"

Option B — account-key SAS. If you would rather not assign a role, generate an account-key shared access signature scoped to the container with Read and List permissions, and share it through a secure channel.

# Read + List account-key SAS on the container, expiring at a date you choose
az storage container generate-sas \
  --account-name <storage-account> \
  --name focus-exports \
  --permissions rl \
  --expiry 2027-01-01 \
  --auth-mode key \
  -o tsv

An account-key SAS bypasses Entra (AAD) authentication, so scope it tightly: this container only, Read + List only, and rotate it on a schedule. A user-delegation SAS (--auth-mode login --as-user) is AAD-backed, but Azure caps its lifetime at 7 days and rejects a longer expiry.

Either grant is read-only: neither lets the platform write to, modify, or delete anything in the container.

Trade-offs at a glance

	Cost API lane (default)	FOCUS export lane (appendix)
Freshness	Daily	Monthly (trails the daily lane)
Roles	Cost Management Reader + Reader	Adds Storage Blob Data Reader (or a container SAS)
Extra infrastructure	None	A storage account container
Best for	Almost every estate	Subscriptions where the daily Cost Details export becomes too slow to complete overnight; portable standard dataset

The two lanes coexist — running FOCUS does not remove the daily lane. If in doubt, start with the daily lane in connect Azure and add this later if scale makes it worthwhile.

---

Next: Dashboards — the four persona boards each lane carries.