Enterprise Agreement (EA)

Connect your Enterprise Agreement (EA) account to CloudZero in five steps and see your Azure costs in a unified view within 24 hours. CloudZero connects through a read-only application registered in your Azure tenant (called a service principal). CloudZero uses the EnrollmentReader role, which provides read-only access to usage, billing, and discount data across all accounts and subscriptions in your enrollment. CloudZero also adds the tax from each Azure invoice as a separate Tax line, so your CloudZero total includes the tax on your invoice. The tax line appears once Azure issues the invoice for that billing period.

For full details on what CloudZero accesses, see Azure Permissions and Security.

Overview

Connecting an EA account takes five steps:

1. Retrieve IDs from Azure
2. Configure the connection in CloudZero
3. Authorize CloudZero in your Azure tenant
4. Grant CloudZero read access to your billing data
5. Verify the connection

What you need

• CloudZero user with data configuration permissions
• In Azure, the Billing Account Owner role on the billing account you plan to connect (required to assign the EnrollmentReader role to the CloudZero application)

Step 1: Retrieve IDs from Azure

You need two IDs: your tenant ID and your billing account ID.

Retrieve your tenant ID

1. In the Azure Portal, navigate to your tenant directory (Microsoft Entra ID).
2. Copy the Tenant ID for use in Step 2.

Retrieve your billing account ID

1. Navigate to Cost Management + Billing and select the billing account you plan to connect.
2. In the left menu, under Settings, select Properties.
3. Copy the 8-digit Billing Account ID for use in Step 2.

Step 2: Configure the connection in CloudZero

1. In CloudZero, go to Settings > Connections.
2. Select Create Connection +.
3. Select the Azure tile, then choose the Billing tile.
4. Enter a Connection Name using letters, numbers, hyphens, or underscores only.
5. Leave Auto-detect selected in the Azure Agreement Type drop-down menu. CloudZero identifies your agreement type from the 8-digit billing account ID.
6. Paste the tenant ID you copied in Step 1 into the Tenant ID field.
7. Paste the billing account ID you copied in Step 1 into the Billing Account ID / Subscription ID field.
8. Select Create Connection.

Auto-detect recognizes only the 8-digit billing account ID. If you connect a different EA ID, such as a department or enrollment account ID, select Enterprise Agreement in step 5.

Step 3: Authorize CloudZero in your Azure tenant

If you have not connected this tenant to CloudZero before, CloudZero redirects you to Azure to register the CloudZeroPlatform application (service principal) in your tenant.

If you have already granted this authorization, proceed to Step 4.

1. In Azure, check the Consent on behalf of your organization box.
2. Select Accept.

Azure registers the application in your tenant and redirects you to CloudZero.

If CloudZero asks you to grant read access

With Auto-detect selected, CloudZero detects your agreement type as soon as you authorize CloudZero, and it needs read access to the ID you entered to do that. The first time you connect a tenant, CloudZero doesn't have that access yet, because you grant it in Step 4. In that case, CloudZero returns you to the Connect Microsoft Azure page and shows a Grant CloudZero read access panel. The panel names the reader role to assign (for some IDs, a choice of two roles) and links to the instructions for it.

1. Complete Step 4, assigning the role the panel names.
2. Return to CloudZero and select Detect again.

CloudZero detects your agreement type and finishes setting up the connection.

If the panel also says CloudZero couldn't find the ID you entered, first check that it matches the ID you copied in Step 1. If the ID is correct, assign the role and select Detect again.

If you've already authorized this tenant for another connection, CloudZero skips the Azure authorization. It shows the same panel on the Connect Microsoft Azure page when you select Create Connection, if it needs the role.

If you leave before finishing, go to Settings > Connections, where the connection shows Setup Incomplete. Select Resume setup to return to the panel.

Step 4: Grant CloudZero read access to your billing data

The EnrollmentReader role cannot be assigned through the Azure Portal. You can use the CloudZero PowerShell script (Option A) or assign the role through Azure's REST API (Option B).

You must have the Billing Account Owner role on the billing account to assign the EnrollmentReader role to the CloudZero application.

Option A: Use the CloudZero PowerShell script

1. Open a PowerShell session. You can use Azure Cloud Shell (select PowerShell if prompted) or run PowerShell locally. If running locally, install the Azure PowerShell module and sign in with Connect-AzAccount.

2. Download the script:

   • Cloud Shell or command line: Run the following command:
     PowerShell

     Invoke-WebRequest -Uri "https://raw.githubusercontent.com/Cloudzero/provision-account/develop/azure/cz_azure_billing_permissions_setup.ps1" -OutFile "./cz_azure_billing_permissions_setup.ps1"

   • Manual download: Download the script from the CloudZero provision-account repository and place it in your working directory. For full usage details, see the README.

3. Run the script with the billing account ID you copied in Step 1:

   PowerShell

   ./cz_azure_billing_permissions_setup.ps1 -BillingAccountId <your-billing-account-id>

4. Proceed to Step 5.

Option B: Assign the role using the Azure REST API

Because the EnrollmentReader role is not available in the Azure Portal, this method uses Azure's interactive REST API documentation to assign the role.

Get the CloudZeroPlatform Object ID

1. In the Azure Portal, navigate to Enterprise applications.
2. Select the CloudZeroPlatform application.
3. On the Overview page, in the Properties section, copy the Object ID for use in a later step.

Assign the EnrollmentReader role

1. Open the Role Assignments - Put page in Azure's REST API documentation. This page provides an interactive form that lets you assign billing roles by sending requests directly to Azure's API.

2. Select the Try it button to open the interactive request form.

3. Sign in with your account credentials to the tenant with the enrollment access you want to assign.

4. In the Parameters section, enter the following values:

   Parameter	Value
   billingAccountName	The 8-digit billing account ID from Step 1
   billingRoleAssignmentName	A randomly generated GUID (see note below)
   api-version	2019-10-01-preview

   Generating a GUID for billingRoleAssignmentName: Azure uses this value as a unique name for the role assignment. No specific value is required; any valid GUID works. Generate one using a tool like the Online GUID Generator, or run New-Guid in PowerShell. Copy your generated GUID and paste it into the field.

5. Copy the following JSON and paste it into the Body section, replacing the three placeholders:

   JSON

   {
     "properties": {
       "principalId": "{YOUR-OBJECT-ID}",
       "principalTenantId": "{YOUR-TENANT-ID}",
       "roleDefinitionId": "/providers/Microsoft.Billing/billingAccounts/{YOUR-BILLING-ACCOUNT-ID}/billingRoleDefinitions/24f8edb6-1668-4659-b5e2-40bb5f3a7d7e"
     }
   }

   Placeholder	Replace with
   {YOUR-OBJECT-ID}	The CloudZeroPlatform Object ID copied above
   {YOUR-TENANT-ID}	The tenant ID from Step 1
   {YOUR-BILLING-ACCOUNT-ID}	The 8-digit billing account ID from Step 1

   The value 24f8edb6-1668-4659-b5e2-40bb5f3a7d7e is the role definition ID for the EnrollmentReader role.

6. Verify that the Request Preview URL matches this format:

   https://management.azure.com/providers/Microsoft.Billing/billingAccounts/{billingAccountName}/billingRoleAssignments/{billingRoleAssignmentName}?api-version=2019-10-01-preview

7. Select Run. A 200 OK response confirms the role was assigned successfully.

If you receive an error, see Azure's troubleshooting documentation.

Step 5: Verify the connection

1. In CloudZero, go to Settings > Connections.
2. Select the newly created Azure connection in the Billing Connections table.

On the connection details page, you can see the connection status, tenant ID, billing account ID, agreement type, and ingestion timestamps.

What to expect

After CloudZero processes the first data ingest, the connection status changes from Pending Data to Healthy. This can take several hours. Cost data appears across the platform within a day.

Until the first data ingest, you can change the connection's agreement type. After that, the agreement type is locked. For details, see Change the agreement type.

You can connect additional Azure accounts at any time by repeating this process. CloudZero supports organizations with multiple tenants.

Once your billing connection is active, you can also connect resource metadata for deeper cost analysis.

If your organization is migrating to a Microsoft Customer Agreement, see Migrating from an Enterprise Agreement on the MCA page.

Your EA billing balances include any adjustments Microsoft applied for the period. For how CloudZero brings those into your cost data, see Azure credits and adjustments.