Connecting to Azure

Connections are how CloudZero manages the various Cost Sources that bring Billing, Resource, and other types of data into the platform.

📘

But First...

Every CloudZero customer must first connect an AWS Management/Payer Account to get started, so please confirm that you have followed the AWS Connection process before trying to add an Azure Connection.

How the Azure Connection Works

Connecting to an Azure account will show Azure cost data alongside other Cost Sources in the Explorer, as well as enable anomaly alerts on Azure spend.

The CloudZero platform will ingest Azure Cost data by using the Azure Cost Management + Billing Exports feature. There will need to be 4 different exports configured in order for the CloudZero platform to be able to get accurate cost information. These exports will consist of a daily and monthly export for both actual and amortized Cost Metrics.

In the following steps, you will find instructions on how to run a PowerShell script that will generate these exports for you, or the manual steps required to create the exports yourself.

📘

About CloudZero's Access to your Azure Accounts

All of CloudZero's permissions are Read-Only
We have no access to data except where explicitly authorized (for example, the data you explicitly share with CloudZero). The PowerShell script we offer through the application does require write permissions, just to create the read-only resources for you.

Summary of Permissions:

  • Storage Blob Data Reader: Grants read access only, to allow loading data from Billing Export files stored in the Storage Account
  • For MCA Accounts:
    • Billing Account Reader role: Grants read access only, to billing and invoice data. This allows CloudZero to determine invoice details not found in the exported data from above, like taxes assessed on the usage.
  • For Enterprise Agreement (EA) Accounts:
    • Enrollment Reader role: Can view usage and charges across all accounts and subscriptions. Can view the Azure Prepayment (previously called monetary commitment) balance associated with the enrollment.

Connect an Azure Billing Account

Open the Connections page

The Connections page can be found by going to the "gear" on the sidebar and selecting "Connections" or alternatively going to https://app.cloudzero.com/organization/connections

CloudZero ConnectionsCloudZero Connections

📘

Note: Organizer Role Required

You must be a CloudZero Organizer to add new Connections to the platform.

Add an Azure Billing Account

On the Connections page you can see all of the Connections in your system. To connect an Azure Billing Account, click the “Add New Connection” button.

The first step is to fill in some Azure Tenant and Billing Account information on the next page:

  • Connection Name: This is the name you will see throughout the CloudZero UI, in addition to the Azure Billing Account ID.
  • Tenant ID: This is the ID at the top of your Microsoft Azure account, which can be found here.
  • Billing Account ID: The ID of the Billing Account you are connecting, which can be found in the Azure Portal:
    • Navigate to Cost Management + Billing
    • Click on Properties in the left navigation panel
    • For EA Accounts:
      • The account ID should be an 8 digit number (i.e. 12345678)
    • For MCA Accounts:
      • Find the account ID and click the Copy button (see image below)
        Azure PortalAzure Portal

Click the Save button.

📘

Redirect to Azure for Authorization

When you click Save, if you have not added this Tenant ID to CloudZero before, you will be redirected to the Azure portal to grant CloudZero’s multi-tenant app the necessary access.

Azure Permission DialogAzure Permission Dialog

Granting this access creates the Azure service principal for the CloudZeroPlatform multi-tenant app. This service principal acts just as a user in your AAD tenant and can be given permissions to interact with resources or read data through Azure APIs.

NOTE: When initially created, the service principal will not actually have any permissions granted to it. You must grant the necessary permissions as noted in later steps. The Scripted option described later will do this for you.

Grant Access For CloudZero’s Snowflake App

Once you have granted CloudZero's multi-tenant app the necessary access in Azure, you will be redirected back to the New Azure Connection screen and will need to complete the following step to give CloudZero’s Snowflake Storage Integration access to your Azure tenant.

Click the Connect CloudZero's Snowflake App button. A new window will open and display a Microsoft permissions request page. Click the Accept button.

Azure Permission DialogAzure Permission Dialog

This action allows the Azure service principal created for CloudZero's own Snowflake account to obtain an access token on any resource inside your tenant. Obtaining an access token succeeds only if you grant the service principal the appropriate permissions on the container, which you will do in one of the steps below.

After pressing Accept, the browser redirects to the Snowflake root page. This is expected; simply close that other window.

Configure Billing Exports

You have two options to configure the billing exports - either by running a PowerShell script that we provide (this is the preferred option as it should save you time sand reduce human error), or by manually completing the steps in the Azure Portal as outlined below.

Scripted Option (Preferred)

If you choose the Scripted Option, you will provide two pieces of information so that the system can generate a PowerShell script that you can then run to automatically create the necessary Billing Exports.

  • Storage Account: This is the URL of the storage account you would like to use or create where the Billing Exports will be stored
  • Container Name Path: e.g. “cz-billing-data-export” or whatever name you would prefer to use

Click the Generate Script button and then copy the script that is generated and run it in PowerShell.

The script will create the four Billing Exports, grant the CloudZero Snowflake App permission to the storage account where those exports are created, and grant the CloudZero Service Principal access to the Billing API.

📘

Note: Permissions Required to run Script

In order to execute the PowerShell script, you must have the following roles:

  • Billing Account Owner on your main Billing Account. This is required so you can assign reader permissions to the CloudZero Service Principal as well as create the required export jobs.

Azure Add Role Assignment ScreenAzure Add Role Assignment Screen

  • Minimum of Owner in a subscription. This enables you to create the required storage account and assign reader access to both the Snowflake and CloudZero Service Principals.

Once you have run the script and everything has successfully been created and permissions granted, return to the CloudZero screen and click the Save button.

Manual Option

Alternately, you can follow these steps to create the four Billing Exports that CloudZero will need.

Once you have completed all of these manual steps, return to the CloudZero screen and provide the following information based on what you just created:

  1. Storage Account: This is the URL of the storage account re-used or created where the Billing Exports will be stored
  2. Container Name Path: e.g. “cz-billing-data-export” or whatever name you chose to use
  3. Click the Save button.

Return to the Connections Page

Once complete, your Azure Connection will appear on the CloudZero Connections page in the Billing Connections table.

CloudZero will then attempt to connect to the Azure Storage Account to verify the connection is working.

CloudZero ConnectionsCloudZero Connections

Once the connection has been verified, the Health column will update from “Pending Data” to “Healthy”. Discovery can take up to an hour. It can take up to a day to synchronize new accounts before you see cost data in the Explorer.

If something changes on your side and CloudZero can no longer use the role that was just granted permissions, the Health will change and provide details on why CloudZero cannot connect.

You can connect any other Azure Accounts you want at this point with the same process.

📘

Note: Today USD is the only supported currency

Reach out to your CloudZero representative if your Azure cost is billed in a different currency.

Connecting Other Cost Sources

Additionally, you may want CloudZero to help with your other AWS or Snowflake costs, or the custom costs you can bring in using an AnyCost Adaptor.

Start by learning about CloudZero Connections, or choosing a Cost Source from the What's Next section below: