Connect Azure

What you’ll need

• Role: someone who can register applications in Entra and assign roles at subscription scope — typically a Global Administrator or a subscription Owner.
• Scope: the subscriptions you want analysed. Start with one and add others later if you prefer.
• Time: under an hour of your team’s time, then one nightly run before dashboards populate.

Validated against the Azure portal on 27 July 2026.

The default path reads your spend through the Azure Cost Details API at daily granularity — two built-in read-only roles per subscription, granted to a service principal in your own tenant, and no storage setup.

Three checklist steps are conditional:

• Step 4 (Conditional Access) applies only if a workload-identity policy blocks the app’s sign-in.
• Steps 8 and 9 (Teams webhook, FOCUS export lane) are optional — neither is needed for the visibility tier.

Onboarding checklist

The nine steps below are the path figure 1 draws. Chips 1–7 map to steps 1–7; steps 8 and 9 are optional and not drawn.

Figure 1 — You create the credentials and hold them — two built-in read-only roles are the whole grant, and Azure IAM revokes access the moment you want it gone.

1. Register the infralign-reader app and add a client secret

Create it in your own Microsoft Entra tenant, following Entra app registration.

Done when the app appears under App registrations and you have recorded the Application (client) ID and Directory (tenant) ID. A client secret with a future expiry is listed under Certificates & secrets.

2. Grant the two RBAC roles per subscription

Assign Cost Management Reader and Reader to the app on every subscription you want analysed — what each role unlocks, with the portal and CLI steps. Scope is always per subscription, never the billing account, and ingestion fans out across every granted subscription — a production estate today runs across 10+, with 13 months of cost history backfilled.

Done when infralign-reader appears twice per subscription — once as Cost Management Reader, once as Reader. Verify it in Access control (IAM) → Role assignments, or from the CLI:

az role assignment list --assignee <appId> --all -o table

Principal          Role                    Scope
-----------------  ----------------------  -------------------------------------
infralign-reader   Cost Management Reader  /subscriptions/<subscription-id>
infralign-reader   Reader                  /subscriptions/<subscription-id>

Read-only

Both roles are read-only, so the platform cannot create, modify, or delete anything in your estate — the first of the three gates in the safety model. The full role list, with scopes and justification, is in the permissions reference.

3. Run the validation runbook

The az CLI validation runbook signs in as the service principal and probes each data source, so you know ingestion will land.

Done when probes 1–4 pass on every subscription you granted.

4. Clear Conditional Access for the app

A workload-identity Conditional Access policy can block the service-principal sign-in with an AADSTS error.

Done when the sign-in probe in step 3 succeeds, or you have added an exclusion for infralign-reader.

5. Send Infralign the connection details

Email [email protected] with the Directory (tenant) ID, the Application (client) ID, and the subscription IDs to analyse. Infralign replies with a one-time password-manager share link that you paste the client secret value into. The secret never goes in the email body, an attachment, or a chat message.

Done when Infralign confirms the credentials authenticate and the subscription list is registered.

6. Grant the Infralign Portal sign-in consent

A tenant admin grants this once, for the separate sign-in app — Dashboard sign-in.

Done when Infralign Portal is listed under Enterprise applications in your tenant.

7. Send the dashboard user list

Each user’s email exactly as their Microsoft account asserts it, plus a role of member or admin — details here.

Done when each named user can sign in at app.infralign.ai without a 403.

8. Optional: connect a Microsoft Teams webhook

Not required for the visibility tier. Once connected, your channel receives the nightly pipeline summary card and failure-alert cards.

Done when the first nightly summary card arrives in the channel.

9. Optional: set up the FOCUS export lane

Where the on-demand Cost Details report becomes slow or heavy, a lane built from native FOCUS 1.2 parquet covers that case — at the cost of its own storage account, one extra role, and a monthly cadence that trails the daily lane. Setup is in FOCUS exports and storage setup.

Done when the first monthly export lands in your container and the FOCUS-lane boards populate.

Verifying the connection

Your dashboards populate after the first nightly pipeline run — within 24 hours. See your first day for what to look at first.

Revoking access

Three independent switches, all yours:

• Delete the role assignments on a subscription — ingestion of that subscription stops immediately.
• Delete the infralign-reader app registration — the credentials are dead, everywhere, at once.
• Delete the Infralign Portal enterprise app, or ask Infralign to remove your allowlist entry — dashboard sign-in stops within about a minute.

If the first run doesn’t look right:

Symptom	Cause	Fix
Dashboards empty after the first run	A subscription is missing one of its two role assignments	Re-check Access control (IAM) → Role assignments on every granted subscription
A subscription’s spend is missing, others land	Cost Management Reader was not assigned on that subscription	Assign it, then wait for the next nightly run
Inventory and CPU tiles empty, cost present	Reader was not assigned on that subscription	Assign it, then re-run the validation runbook
Validation probes return AuthorizationFailed minutes after assignment	RBAC propagation	Wait up to ten minutes and re-run
Service-principal sign-in fails with an AADSTS error	A workload-identity Conditional Access policy blocks the app	Add an exclusion

---

Next: Entra app registration — create the service principal and grant its two roles, step by step.