Using Azure Cost Management Storage Export with CostRadar

Storage Export is required for CostRadar cost ingestion. CostRadar reads Azure Cost Management export files from a storage account your team owns in the same subscription being monitored. Direct Cost Management Query API ingestion is not supported. Connecting the Reader service principal alone does not start importing costs.

CostRadar uses read-only access for this flow. It reads the exported cost files and validates the subscription, but it does not create exports for you, write to your storage account, change Azure resources, or enforce budgets.

Azure setup before using CostRadar

In Azure Cost Management, select the monitored subscription scope, then open Exports > Create. If you monitor multiple Azure subscriptions, create a separate export for each subscription and use a separate stable folder root per subscription: the export destination's Directory value. Different Export Names alone do not isolate the Directory scanned by CostRadar. Do not point multiple CostRadar subscription rows at one shared folder that contains mixed-subscription exports.

Use these required settings:

• Export type: cost and usage details.
• Schedule: active daily export of month-to-date costs, with daily granularity.
• Destination: a Blob Storage container in a storage account your team controls in the same subscription being monitored. Cross-subscription destinations are not supported by CostRadar, even if Azure allows creating them.
• Azure resource provider: the destination storage account subscription must have Microsoft.CostManagementExports registered. If Azure shows an RP Not Registered or Register destination storage account subscription with Microsoft.CostManagementExports error, an Azure Owner/Contributor or your admin-approved policy path must register it before creating the export.
• File format: CSV with gzip compression.
• Cost type: actual cost. CostRadar's current customer setup flow imports actual-cost exports.

Azure exports are not real-time. New or revised billing data appears only after Azure publishes it and the export run writes files to your storage account. CostRadar's scheduled ingestion can run daily, but it decides what to import by looking for the newest manifest/export blobs under the stable root folder; if Azure has not written a new run yet, CostRadar cannot manufacture fresher data.

When daily ingestion runs

Set the Azure export to run daily/month-to-date, then leave CostRadar pointed at the stable export root. Azure does not guarantee one universal completion time across all tenants and billing scopes, so CostRadar should be treated as a polling importer: CostRadar checks eligible tenants hourly during a bounded daily polling window and imports the newest completed manifest or CSV set it can read. If Azure has not published a newer export yet, CostRadar keeps showing the last imported data and labels the dashboard with the latest usage date covered, last import time, and last check status.

A good troubleshooting signal is the blob timestamp/path: if the newest manifest.json or CSV partition under the configured root is still from yesterday's export run, CostRadar will continue showing the last imported data until Azure writes a newer completed export.

Required Azure roles and provider registration

Before creating the Azure Cost Management export, confirm the Microsoft.CostManagementExports resource provider is registered in the subscription that owns the destination storage account. For CostRadar, this must be the same subscription being monitored. Do not use a destination storage account in a different subscription.

Azure CLI setup and check (replace YOUR_SUBSCRIPTION_ID with the monitored/destination subscription ID; registration is a configuration change, not a read-only check):

az provider register --namespace Microsoft.CostManagementExports --subscription "YOUR_SUBSCRIPTION_ID" --wait
az provider show --namespace Microsoft.CostManagementExports --subscription "YOUR_SUBSCRIPTION_ID" --query registrationState -o tsv

The expected state is Registered. Provider registration is a subscription-level Azure setup action; the CostRadar read-only service principal cannot perform it. This registration is separate from the read-only roles CostRadar uses: subscription Reader for validation/resource metadata and Storage Blob Data Reader for blob data-plane access to export files.

Use the CostRadar service principal that is connected to this subscription. CostRadar recommends a separate service principal per monitored Azure subscription for simpler setup, cleaner isolation, and easier revocation.

For the full product experience, grant:

| Purpose | Azure role | Recommended scope | |---|---|---| | Subscription validation, resource metadata, tags, and Advisor recommendations | Reader | Monitored Azure subscription | | Reading exported cost files | Storage Blob Data Reader | Export blob container, or the narrowest storage-account scope that covers the export container |

Storage Blob Data Reader is the role that lets CostRadar read files from Blob Storage. Subscription Reader alone does not grant blob data-plane access. If Azure has not created the export container yet, assign Storage Blob Data Reader on the destination storage account. After the first export creates the container, you may narrow that assignment to the container. CostRadar can validate the export's control-plane destination while it waits, but it cannot prove blob data-plane access until the container exists.

CostRadar does not need Owner, Contributor, or write access for ongoing ingestion.

Setup administrator and storage networking

The person creating the export needs permission to create subscription-scoped Cost Management exports and configure the destination storage. App registration, role assignment, and provider registration are separate setup permissions; ask your Azure administrator rather than granting CostRadar administrative access.

Azure Cost Management writes the files using its export managed identity where configured. This writer is separate from CostRadar's read-only service principal. Firewalled export destinations can require role-assignment permissions during setup and the trusted-Azure-services exception for the export writer. Allowing that writer does not grant CostRadar network access. Blob RBAC alone does not bypass a storage firewall or private endpoint. If storage networking is restricted, contact support and your Azure administrator to confirm a supported access path; do not disable your firewall or make blobs public as a workaround. See Microsoft's export prerequisites.

Where to configure Storage Export in CostRadar

1. Connect the Azure subscription in CostRadar using the normal Azure subscription connection flow.
2. Go to Dashboard > Azure Subscriptions.
3. Find the connected subscription row.
4. Select Use Storage Export or Edit Storage Export.
5. Enter the Storage Account Resource ID, Container Name, and Export Folder Path, then select Validate & Enable Storage Export. CostRadar does not need the Azure Export Name and does not ask you to choose compression.
6. If Azure has not published the first completed export yet, CostRadar shows Waiting for first export instead of a failure. You can leave the page; CostRadar will keep checking automatically during its configured daily polling window.

CostRadar first uses the connected service principal to read the storage account resource and find a subscription-scoped Azure Cost Management export whose destination matches the Storage Account Resource ID, Container Name, and Export Folder Path. If that control-plane setup is valid but Azure has not created the container or published a completed export file yet, CostRadar stores the configuration as Waiting for first export and checks automatically. Once the container exists, CostRadar also verifies Blob Data Reader access and the completed export files; do not keep clicking the setup button unless you changed the Azure configuration.

Fields in the CostRadar Storage Export form

Before entering these fields, make sure Azure can create the Cost Management export: the destination storage account subscription should show Microsoft.CostManagementExports as Registered. If Azure shows an RP Not Registered error, register that provider first, then return to CostRadar.

Storage Account Resource ID

Enter the full Azure Resource Manager ID for the storage account, for example:

/subscriptions/YOUR_SUBSCRIPTION_ID/resourceGroups/YOUR_RESOURCE_GROUP/providers/Microsoft.Storage/storageAccounts/YOUR_STORAGE_ACCOUNT

You can copy this from Azure Portal by opening the storage account and checking Properties or JSON view.

Container Name

Enter the blob container where Azure Cost Management writes the export files, for example:

costradar

The CostRadar service principal needs Storage Blob Data Reader on this container or on a storage-account scope that includes this container.

Export Folder Path

Copy the export destination's exact Directory value (API field deliveryInfo.destination.rootFolderPath), preserving letter case. Use a nonempty Directory dedicated to this subscription. Do not infer this value by taking the folder immediately above the date-range folder: Azure inserts an Export Name level below Directory.

For example, if Azure writes files like this:

exports/costradar-export/20260601-20260630/RUN_ID/manifest.json
exports/costradar-export/20260601-20260630/RUN_ID/part-0000.csv.gz

with Directory exports and Export Name costradar-export, enter:

exports

Do not append the Export Name, date-range folder, RunID folder, manifest path, or individual CSV file path. For this example, exports/costradar-export is not the Directory and fails the exact export-destination match. If your Directory itself contains multiple segments, copy all of those segments exactly. CostRadar requires the configured Directory, not a guessed parent folder.

For accounts with multiple Azure subscriptions, create a separate export and a separate stable folder root (Directory) per subscription. Each CostRadar subscription row must use an export folder that contains only that subscription's cost files. If CostRadar finds rows for another subscription ID in the configured export, validation/import fails instead of silently mixing costs.

Cost type, format, and compression

Cost type is fixed to actual cost in the current CostRadar setup flow. Configure the Azure export as CSV with gzip compression so it writes files ending in .csv.gz. There is no compression setting in the CostRadar setup form, and you do not need to enter the Azure Export Name: CostRadar finds export files from the Storage Account Resource ID, Container Name, and Export Folder Path.

Common validation errors

Access denied or unable to read blobs

Confirm Storage Blob Data Reader is assigned to this subscription's CostRadar service principal on the export container or storage account. Role assignments can take a few minutes to propagate.

Azure says the Cost Management Exports resource provider is not registered

Register Microsoft.CostManagementExports in the destination storage account subscription, then retry export creation. If your Azure policies block provider registration, ask an Azure Owner, Contributor, or cloud administrator to perform the registration. CostRadar does not need ongoing Contributor/Owner access after the export and read-only roles are configured.

No export files found

If you just created the Azure export, this can be a normal first-run state. Azure says the first export can take up to 24 hours; billing-data availability and setup failures can cause further delays. CostRadar stores a validated configuration as Waiting for first export and checks automatically. If the export should already exist, check its Run history and confirm Export Folder Path exactly matches the destination Directory.

Wrong root folder

If you pasted an Export Name, date range, RunID, manifest.json, or individual CSV file path, replace it with the exact destination Directory. For Directory exports, use exports, not exports/costradar-export or exports/costradar-export/20260601-20260630/RUN_ID.

Data appears delayed after validation

Azure billing data and Azure export files can lag. CostRadar can import only the files Azure has already published to the storage container. Recent current-month data may change as Azure revises billing data.

What to send support

If Storage Export still fails, send support the subscription display name, the storage account name, the container name, the export folder path you entered, the approximate time the Azure export last ran, and the validation error text. Do not send client secrets, access keys, SAS URLs, or exported cost files in chat.