Native connector
Azure cost management through a principal you control
Costfluent reads Azure cost through a service principal you create and grant two read-only roles. Every subscription you assign it to feeds the same cost reports, budgets, allocation, insights and savings.
How you connect
One service principal, as many subscriptions as you assign
Create the service principal
Create it in your own tenant with the Azure CLI. You keep its credential, and you can reset or delete it at any time.
Grant two roles
Assign Cost Management Reader and “Reader” on each subscription you want imported, or once at a management group that covers them.
Add the connection
Enter the tenant ID, app ID and credential in Costfluent. They are checked against the Cost Details API before they are saved, so a connection that saves can read your cost.
Subscriptions follow your role assignments
Which subscriptions are imported follows from your role assignments. A subscription granted later appears after the next check, with no new connection.
What is read
Cost details and the metadata that labels them
Cost details report
Cost Management Reader lets Costfluent read the cost details report each import is built on. It covers what each subscription is charged; tax, purchases under a Microsoft Customer Agreement, other charges billed to the billing profile, and credits and prepayment Microsoft applies to the billing account or billing profile are not imported.
Subscription metadata
Reader lets Costfluent read the subscription metadata that labels the cost.
Every subscription the principal reaches
The connection lists each subscription with what it does with it. One the principal can see but not read cost for is shown as unavailable, with the reason.
What you grant
Two built-in read roles, and nothing else
- Cost Management Reader and “Reader” are the only roles Costfluent needs. Do not grant “Contributor” or “Owner”.
- Neither role can change anything in your subscriptions or read workload content.
- You choose the scope: a role assignment per subscription, or one at a management group that also covers subscriptions added to it later.
- To retire the connection, remove it in Costfluent and delete both role assignments and the service principal in Azure.
Related pages
- AWS integration
A read-only IAM role and your FOCUS Data Export in your own S3 bucket.
- Google Cloud integration
Read access to your detailed BigQuery billing export, without service-account keys.
- Kubernetes cluster agent
Node costs distributed across namespaces by an agent you install with Helm.
- All integrations
Every cost source Costfluent reads, with its status.
- Security and data access
Where Costfluent runs, the access each connector needs and how to revoke it.
From the handbook
- Billing data and standards
Azure cost exports: actual, amortized and FOCUS
- Tooling
Azure Cost Management and Billing
- Azure billing and pricing
Azure Virtual Machines pricing
- Azure billing and pricing
Azure Functions and App Service pricing
- Azure billing and pricing
Container Apps, Container Instances and ACR pricing
- Azure billing and pricing
Azure Kubernetes Service pricing
Start with your own Azure costs
Create a Free workspace and connect Azure when you are ready.
Permanent Free plan with no time limit