Connecting Azure with read-only access

CostRadar connects to Azure through a customer-created service principal with read-only permissions. For the simplest setup, create a separate service principal for each Azure subscription you connect. The current onboarding flow requires subscription Reader first; Storage Export is required for cost ingestion and blob access is added after that Reader connection is verified. Connecting Azure access alone does not import costs.

Current recommended permission set

For each monitored subscription, the recommended simple setup is one service principal with:

| Purpose | Azure role | Scope | |---|---|---| | Subscription validation, resource names/tags through Azure Resource Graph, and Azure Advisor recommendations | Reader | The monitored Azure subscription | | Storage Export cost ingestion | Storage Blob Data Reader | The export container, or the narrowest storage-account scope that covers the export container/prefix |

The Storage Blob Data Reader role is the role CostRadar uses to read exported cost files. It does not replace subscription Reader. Subscription Reader is required during onboarding and is used for subscription validation, resource metadata/tags, and Azure Advisor recommendations. CostRadar does not need Contributor or Owner for ongoing ingestion.

Values you need from Azure

When you connect a subscription, CostRadar asks for:

• Azure tenant ID.
• Azure subscription ID.
• Application client ID for the service principal.
• Client secret value for that application.
• Service Principal Name: a friendly label, required during initial onboarding and optional when adding another subscription from the dashboard. It is not a credential and does not replace the Application client ID; it does not need to match the Azure subscription name.

Azure only shows a new client secret value once. Copy it when it is created and store it according to your team's credential process.

Visual walkthrough

If you prefer the Azure Portal path, watch the app registration setup walkthrough: https://youtu.be/meAshZWpMZw

Use the video for the Entra app registration and client secret steps, then return to CostRadar to enter the tenant ID, subscription ID, application client ID, and client secret value.

Cloud Shell setup

Use Bash in Azure Cloud Shell. The person doing setup needs permission to register an application in Microsoft Entra ID and assign roles at the monitored subscription scope. These are separate permissions; ask your Azure administrator if either is unavailable. CostRadar itself does not need those administrative permissions.

Select and verify the subscription and tenant first. Replace YOUR_SUBSCRIPTION_ID before running the selection command:

az account list --query "[].{Name:name,Subscription:id,Tenant:tenantId}" --output table
# Run the list first; replace YOUR_SUBSCRIPTION_ID before running the next command.
az account set --subscription "YOUR_SUBSCRIPTION_ID" && az account show --query "{Name:name,Subscription:id,Tenant:tenantId}" --output json

Create a new service principal scoped to that subscription. Do not rerun this creation command for an existing connection: reusing a display name can modify an existing application or its credentials. For an existing connection, use the secret-replacement flow below; if creation partially failed, ask your Azure admin to inspect the existing app before retrying. Use a distinct name for each new app:

az ad sp create-for-rbac \
  --name "costradar-reader-YOUR_SUBSCRIPTION_ID" \
  --role "Reader" \
  --scopes /subscriptions/YOUR_SUBSCRIPTION_ID

Replace YOUR_SUBSCRIPTION_ID with the subscription you want to connect. The command returns the values that map to CostRadar's connection form. If you later connect another subscription, create a new service principal for that subscription and repeat the same role assignments.

Next, complete the required Storage Export setup. CostRadar currently requires the destination storage account to be in the same subscription being monitored. Confirm that subscription has the Azure Cost Management Exports provider registered. Replace YOUR_SUBSCRIPTION_ID below; registration changes Azure setup and must be performed by an authorized administrator, not the CostRadar read-only service principal:

az provider register --namespace Microsoft.CostManagementExports --subscription "YOUR_SUBSCRIPTION_ID" --wait
az provider show --namespace Microsoft.CostManagementExports --subscription "YOUR_SUBSCRIPTION_ID" --query registrationState -o tsv

The expected state is Registered. Then grant the connected app Storage Blob Data Reader. Replace every placeholder below; use storage-account scope initially if the export container does not exist yet:

az role assignment create \
  --assignee <APP_ID_FROM_CREATE_OUTPUT> \
  --role "Storage Blob Data Reader" \
  --scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Storage/storageAccounts/<STORAGE_ACCOUNT>/blobServices/default/containers/<CONTAINER>

Use the container scope once it exists. If it does not exist yet, use the same scope without /blobServices/default/containers/<CONTAINER>; storage-account scope grants read access to all blobs in that account. After Azure creates the container, add the container-scoped assignment and remove the broader assignment if your administrator chooses to narrow access. Role changes can take time to propagate. Never paste the command's secret output into support chat or source control.

Portal setup

You can also create the app registration manually in the Azure portal:

1. Create an app registration in Microsoft Entra ID for this subscription. For multiple subscriptions, create a separate app registration/service principal per subscription unless your Azure administrator chooses an advanced shared-app model.
2. Create a client secret and copy the value.
3. Assign the built-in Reader role to the app registration at the Azure subscription scope.
4. Copy the tenant ID, subscription ID, application client ID, and client secret value into CostRadar. Supply a friendly Service Principal Name during initial onboarding.
5. After connection, complete the required Storage Export setup in the same subscription. An authorized administrator registers Microsoft.CostManagementExports if needed and creates a daily month-to-date Actual Cost export.
6. Assign Storage Blob Data Reader to the connected service principal on the storage account if the container does not exist yet, or on the export container once it exists.
7. Select Use Storage Export from the connected subscription row and validate the storage configuration. No cost ingestion can occur until this setup is accepted and Azure publishes readable files.

Replacing an expiring or expired client secret

The account owner can use Settings > Connected Subscriptions > Replace client secret, or the Azure Subscriptions page. Create a new client secret under Certificates & secrets in the same Azure app registration, then enter its Value, not its Secret ID, into CostRadar's replacement form. Do not paste credentials into support chat.

CostRadar validates the replacement by obtaining an Azure token and reading the subscription before saving it encrypted. This does not prove the exact Reader role assignment or Blob permissions. A rejected replacement leaves the saved credentials unchanged. Successful replacement preserves the connection, Storage Export settings, and retained cost history; there is no need to disconnect. Keep the old secret until replacement is confirmed. Storage access and ingestion are checked on the next scheduled import; saving does not immediately run an import or prove Blob permissions.

If an import detects an expired or invalid client secret, CostRadar shows a warning and pauses Azure import attempts for that connection until its secret is replaced. Other subscriptions continue. Existing history remains subject to normal retention, but may be stale. Check the last imported date rather than interpreting missing updates as zero spend. Replacement is for the same app and directory; changing either still requires the separate disconnect/connect workflow.

CostRadar does not currently send advance secret-expiry reminders or credential-expiry emails. The warning appears in the dashboard and connected-subscription screens after a failed authentication is detected. Maintain your own Azure secret-expiration reminders.

Permission boundaries

CostRadar uses the credentials to read Azure billing data, configured export files, resource metadata/tags, and Azure Advisor recommendations where available. It cannot use Reader or Storage Blob Data Reader access to deploy resources, change configuration, stop workloads, alter networking, enforce budgets, or write to your storage account.

If your organization requires narrower access, contact support before changing the roles. Storage Export cost ingestion itself needs blob read access to the export files; resource metadata and Advisor features require read visibility to the relevant Azure resources.