Data sources

Infralign reads five sources in your tenant and nothing else: no agents on your VMs, no network taps, no access to data inside your resources. It also calls one public endpoint that is not a source of your data at all. That is Microsoft’s Azure Retail Prices list, which is unauthenticated, identical for every reader, and carries nothing about your estate. The count that matters for a security review is therefore five, and the sixth row below is a price sheet.

The permissions reference maps each source to the role that grants it.

The five sources in your tenant

All five are read through the two-role service principal: Cost Management Reader for the cost report, Reader for the other four.

The table below is the canonical list. Permissions describes the two roles, and the wizard’s Roles step is the click path for granting them. If you need the list for a firewall rule or a change record, take it from here.

Source	Endpoint · api-version	Role	What it’s used for
Azure Cost Details API	POST …/Microsoft.CostManagement/generateCostDetailsReport · 2024-08-01 (ActualCost + AmortizedCost)	Cost Management Reader	The daily Cost API lane; dashboards, reports, audit baselines, savings verification
Azure Resource Graph	POST …/Microsoft.ResourceGraph/resources · 2022-10-01 (also AdvisorResources + ResourceChanges tables)	Reader	Resource inventory and metadata; mapping cost to what’s deployed; orphaned-disk detection
Azure Advisor	Microsoft.Advisor/recommendations/read (via Resource Graph)	Reader	An input signal for findings, enriched with utilisation evidence
Azure Monitor metrics	GET {resourceId}/providers/microsoft.insights/metrics · 2023-10-01	Reader	Idle-VM detection and rightsizing confidence levels
Azure Activity Log	GET …/Microsoft.Insights/eventtypes/management/values · 2015-04-01	Reader	”What changed” context behind cost movements

Those five power the visibility tier and the audit baseline. When the first of that data reaches a screen is covered on dashboards.

The sixth call: a public price sheet

Lookup	Endpoint	Role	What it’s used for
Azure Retail Prices	GET https://prices.azure.com/api/retail/prices	None (public, unauthenticated)	€ impact on findings; Reservation and Savings Plan coverage views

This is not a sixth source of your data, which is why the diagrams count five and this page does too. It is Microsoft’s published list price catalogue: the same response for every caller, requiring no role, no consent and no identity, and carrying nothing about your tenant. Infralign reads it to put a euro figure on a finding. Nothing about your estate is sent to it, and no part of it is specific to you.

Three things a reviewer usually asks about the five:

• Monitor metrics, never Monitor logs. Microsoft.Insights/metrics and Microsoft.OperationalInsights are different providers. The nightly run reads the first and never queries the second, so no Log Analytics workspace is read, no matter what Reader would permit. Metrics are what size an oversized VM or spot an idle disk from its own utilisation rather than from its price.
• Resource Graph reads a change table. Inventory queries also hit the ResourceChanges table, which needs Microsoft.Resources/changes/read. Reader’s blanket */read covers it.
• Reservation and savings-plan coverage needs no permission of its own. No reservations API is called. Coverage comes out of the amortised cost rows, where a commitment appears as a benefit identifier on the charge, so it is a cost-record fact rather than a separate grant.

Appendix lane: FOCUS 1.2 exports

For estates whose daily Cost Details export outgrows the nightly window, an optional export-based lane reads native FOCUS 1.2 parquet via azcopy from a storage container you control. It needs an extra storage grant and trails the daily lane on freshness, so it is documented separately in FOCUS exports and storage setup.

The nightly run

Ingestion runs once a night, fanning out across every subscription you’ve granted (10+ in a production estate). Each run moves through fixed stages:

Time	Stage	What happens
02:30	Acquire	Pull from every source above
03:45	Derive	Shape raw data through the medallion warehouse (bronze → silver)
04:45	Build	Build gold tables and marts
05:45	Sync	Refresh the dashboards against the new data
06:15	Ready	The night’s data is in place and the dashboards are serving it

On first connection Infralign backfills up to 13 months of cost history, so dashboards and reports open with trend rather than a single day.

What is never read

• Data inside your resources: database contents, VM filesystems, blob data (other than the FOCUS export container), application logs, or secrets.
• Anything that would change your estate. The roles are read-only: permissions lists every action they cover.

Progressive attribution

Progressive, not upfront

You don’t need clean tags or complete documentation before connecting. Infralign begins with billing and resource metadata alone. Ownership and allocation are then attributed progressively over the audit and engagement, as the architect correlates naming, subscription structure, and the context you add in the working session.

Revoking access

Remove every role assignment held by the Infralign application at your scope, then disable or delete the application; collection stops within about 10 minutes. The full procedure, covering how many roles that is, why the order matters, and what happens to data already collected, is in ending the connection, which owns it.

Retention and deletion

Up to 13 months of cost history is backfilled when you connect. The retention term and what happens at the end are in the DPA key terms; the procedure is in ending the connection.