Skip to content
Infralign Infralign Infralign docs

Getting started

How your data flows

Where your cost data goes each night, from two scoped Azure roles to the warehouse, and why nothing writes back.

Infralign reads your Azure estate once a night and writes nothing back.

A service principal with the two read-only roles pulls cost and resource metadata into a warehouse, which feeds dashboards, reports, the chatbot, and findings. Figure 1 shows that path.

Three stacked bands. The top band is your Azure tenant: development, staging, production and hub subscriptions, plus five read-only sources named Cost Management, Resource Graph, Advisor, Monitor metrics and Activity Log, reached with the Cost Management Reader and Reader roles. One scoped service principal carries that data down into the middle band, which is Infralign: a nightly run from 02:30 to 06:15 UTC, a bronze parquet layer, a gold warehouse, and four outputs labelled dashboards, reports, chatbot and findings. A red circle-slash between the two bands marks the path that does not exist: nothing is written back to your estate. Below the four outputs, a cyan arrow drops out of the chatbot into a cyan Azure OpenAI card, labelled leaves your stack, stays in EU Azure, which states that the chatbot sends your question, the SQL that ran, and the rows it returned. The bottom band is your team, where you approve or reject each finding and no change is prepared without it. Three stacked bands. The top band is your Azure tenant: development, staging, production and hub subscriptions, plus five read-only sources named Cost Management, Resource Graph, Advisor, Monitor metrics and Activity Log, reached with the Cost Management Reader and Reader roles. One scoped service principal carries that data down into the middle band, which is Infralign: a nightly run from 02:30 to 06:15 UTC, a bronze parquet layer, a gold warehouse, and four outputs labelled dashboards, reports, chatbot and findings. A red circle-slash between the two bands marks the path that does not exist: nothing is written back to your estate. Below the four outputs, a cyan arrow drops out of the chatbot into a cyan Azure OpenAI card, labelled leaves your stack, stays in EU Azure, which states that the chatbot sends your question, the SQL that ran, and the rows it returned. The bottom band is your team, where you approve or reject each finding and no change is prepared without it.
Figure 1: The nightly run only reads. Nothing in the flow writes back to your tenant, and the one decision in it is your team's. The one outbound hop is the chatbot's model call, which leaves your dedicated stack but stays inside EU Azure.

The three bands

Section titled “The three bands”
Part of the diagramWhat it is
Top bandYour Azure estate. One service principal, holding the two read-only roles at management group or subscription scope, reads five gated sources across every subscription you pick. Data sources lists every source, endpoint, and role.
Middle bandInfralign. The nightly run, 02:30 to 06:15 (UTC). What is read lands as bronze parquet, then is shaped into a gold warehouse. Dashboards, reports, chatbot, and findings all build from gold.
Bottom bandYour team. You approve or reject each finding, and no change is prepared without that step.
The cyan hopThe chatbot’s model call. It leaves your dedicated stack for Azure OpenAI and stays inside EU Azure, carrying your question, the SQL that ran, and the rows it returned. It is the only outbound hop in the figure. Isolation and data handling covers what it does and does not send.

Not drawn, because it is off unless you turn it on: the optional FOCUS export lane for estates that outgrow the nightly window, which joins bronze instead of the daily Cost Details API and adds a third role. See FOCUS exports and storage setup.

No arrow points back: the flow cannot create, modify, or delete a resource, tag, or export. To revoke collection access, remove every role assignment held by the Infralign application at your scope, then disable or delete the application; collection stops within about 10 minutes. Ending the connection owns that procedure, including how many roles there are to remove and why the order matters.

Where your data lands

Section titled “Where your data lands”

The nightly run copies your billing and resource metadata into Infralign’s warehouse in Microsoft Azure, EU regions, with disaster recovery in a second EU region. Each tenant gets its own isolated databases, and data is encrypted in transit with TLS and at rest on Azure-managed storage.

Metadata only. Never credentials, and never data inside your resources. Security at Infralign states the residency position, and isolation and data handling covers isolation and the chatbot boundary.

Next: Dashboards. The four persona dashboards the gold warehouse feeds.