Reference
Data sources
Every source the platform reads, what it contains, and what it's used for.
The platform reads six Azure sources and nothing else — no agents on your VMs, no network taps, no access to data inside your resources. The permissions reference maps each source to the role that grants it.
Azure sources
Section titled “Azure sources”Each source is read through the two-role service principal: Cost Management Reader for the cost report, Reader for everything else.
| Source | Endpoint · api-version | Role | What it’s used for |
|---|---|---|---|
| Azure Cost Details API | POST …/Microsoft.CostManagement/generateCostDetailsReport · 2024-08-01 (ActualCost + AmortizedCost) | Cost Management Reader | The daily Cost API lane; dashboards, reports, audit baselines, savings verification |
| Azure Resource Graph | POST …/Microsoft.ResourceGraph/resources · 2022-10-01 (also AdvisorResources + ResourceChanges tables) | Reader | Resource inventory and metadata; mapping cost to what’s deployed; orphaned-disk detection |
| Azure Advisor | Microsoft.Advisor/recommendations/read (via Resource Graph) | Reader | An input signal for findings, enriched with utilisation evidence |
| Azure Monitor metrics | GET {resourceId}/providers/microsoft.insights/metrics · 2023-10-01 | Reader | Idle-VM detection and rightsizing confidence levels |
| Azure Activity Log | GET …/Microsoft.Insights/eventtypes/management/values · 2015-04-01 | Reader | ”What changed” context behind cost movements |
| Azure Retail Prices | GET https://prices.azure.com/api/retail/prices | None (public) | € impact on findings; Reservation and Savings Plan coverage views |
These sources power the whole free tier — dashboards, reports, chatbot, and the audit baseline — and populate after the first nightly run, within a day of connecting Azure.
Appendix lane: FOCUS 1.2 exports
Section titled “Appendix lane: FOCUS 1.2 exports”For very large estates only, an optional export-based lane reads native FOCUS 1.2 parquet via azcopy from a storage container you control. It needs an extra storage grant and trails the daily lane on freshness, so it is documented separately in FOCUS exports and storage setup.
The nightly pipeline
Section titled “The nightly pipeline”Ingestion runs once a night, fanning out across every subscription you’ve granted (10+ in a production estate). Each run moves through fixed stages:
| Time | Stage | What happens |
|---|---|---|
| 02:30 | Acquire | Pull from every source above |
| 03:45 | Derive | Shape raw data through the medallion warehouse (bronze → silver) |
| 04:45 | Build | Build gold tables and marts |
| 05:45 | Sync | Refresh the dashboards against the new data |
| 06:15 | Notify | Post the pipeline summary card to your Teams channel |
On first connection Infralign backfills up to 13 months of cost history, so dashboards and reports open with trend rather than a single day.
What is never read
Section titled “What is never read”- Data inside your resources: database contents, VM filesystems, blob data (other than the FOCUS export container), application logs, or secrets.
- Anything requiring a write scope — none is ever granted.
Progressive attribution
Section titled “Progressive attribution”Revoking access
Section titled “Revoking access”Remove the role assignments or delete the app registration and the data flow stops immediately. See permissions for the revocation steps.
Retention and deletion
Section titled “Retention and deletion”Your data is retained while the service is active. On offboarding, your tenant warehouse, the raw copies, and backups are deleted within 30 days, confirmed in writing. Hosting, per-tenant isolation, encryption, and sub-processors are covered in security and data handling.
Next: FAQ — the questions teams ask before connecting Azure.