Skip to main content

Connect Azure

AvailableReviewed 21 August 2026

Connect Azure by pointing FinomateAI at a billing export in a storage account and a service principal that can read that export. The principal must not be a subscription Owner.

Before you begin​

  • Access to the Microsoft Entra tenant that owns the subscriptions
  • Permission to create an app registration
  • A Cost Management export writing to a storage container

What FinomateAI asks for​

FieldPurpose
Azure tenant IDDirectory (tenant) ID
Subscription IDsComma-separated subscriptions in scope
Storage accountAccount that receives the export
Container nameContainer for the export
Blob prefixOptional path
Client secretService principal secret, stored securely
Connect Azure form with tenant ID, subscriptions, storage account and container
Keep the service principal limited to Cost Management read and the export container.

Step 1: Confirm the export​

In Azure Cost Management:

  1. Open Exports.
  2. Create or confirm an export for the subscriptions you want to analyse.
  3. Use a FOCUS or actual-cost export to a dedicated storage account.
  4. Confirm blobs are arriving in the container.
  5. Record storage account, container and prefix.

Wait for the first successful export run before onboarding. An empty container looks like a permissions failure.

Step 2: Create a service principal​

  1. Register an application in Microsoft Entra ID.
  2. Create a client secret. Store it only for the onboarding form — do not paste it into tickets or chat.
  3. Grant:
    • Storage Blob Data Reader on the export container (or account)
    • Cost Management Reader on the subscriptions in scope, if your tenant also queries Cost Management APIs
  4. Do not grant Contributor, User Access Administrator, or any role that can create VMs.

Step 3: Complete onboarding​

  1. Open Complete onboarding and select Azure.
  2. Enter tenant ID, subscription IDs, storage account, container, optional prefix and client secret.
  3. Select Complete onboarding.

Step 4: Validate​

  1. Confirm Healthy on Connected accounts.
  2. In Cost Explorer, select Azure.
  3. Compare a completed period with Azure Cost Analysis for the same subscriptions and grain.

Troubleshooting​

SymptomCheck
Authentication failsTenant ID, application ID, secret value, secret expiry
Container emptyExport schedule and first run
403 on blobsBlob Data Reader is on the right container; firewall allows FinomateAI if the account is locked down
Subscriptions missingSubscription list on the form vs the export
Totals differPeriod, credits, Azure Hybrid Benefit, currency, amortized vs actual

If AWS or GCP is healthy and Azure is not, the fault is this connector — see Manage connected accounts.

Expected result​

FinomateAI can read the approved Azure export, expected subscriptions appear, and a completed period reconciles.