Enterprise Agreement (EA)

Connect your Enterprise Agreement (EA) account to CloudZero in five steps and see your Azure costs in a unified view within 24 hours. CloudZero connects through a read-only application registered in your Azure tenant (called a service principal). CloudZero uses the EnrollmentReader role, which provides read-only access to usage, billing, and discount data across all accounts and subscriptions in your enrollment. EA connections do not include invoice data such as taxes and fees.

For full details on what CloudZero accesses, see Azure Permissions and Security.

Overview

Connecting an EA account takes five steps:

1. Retrieve IDs from Azure
2. Configure the connection in CloudZero
3. Authorize CloudZero in your Azure tenant
4. Grant CloudZero read access to your billing data
5. Verify the connection

What you need

• CloudZero user with data configuration permissions
• In Azure, the Billing Account Owner role on the billing account you plan to connect (required to assign the EnrollmentReader role to the CloudZero application)

Step 1: Retrieve IDs from Azure

You need two IDs: your tenant ID and your billing account ID.

Retrieve your tenant ID

1. In the Azure Portal, navigate to your tenant directory (Microsoft Entra ID).
2. Copy the Tenant ID for use in Step 2.

Retrieve your billing account ID

1. Navigate to Cost Management + Billing and select the billing account you plan to connect.
2. In the left menu, under Settings, select Properties.
3. Copy the 8-digit Billing Account ID for use in Step 2.

Step 2: Configure the connection in CloudZero

1. In CloudZero, go to Settings > Cloud Connections.
2. Select Create Connection +.
3. Select the Azure tile, then choose the Billing tile.
4. Enter a Connection Name using letters, numbers, hyphens, or underscores only.
5. Select Enterprise Agreement from the Azure Agreement Type drop-down menu.
6. Paste the tenant ID you copied in Step 1 into the Tenant ID field.
7. Paste the billing account ID you copied in Step 1 into the Billing Account ID field.
8. Select Create Connection.

Step 3: Authorize CloudZero in your Azure tenant

If you have not connected this tenant to CloudZero before, CloudZero redirects you to Azure to register the CloudZeroPlatform application (service principal) in your tenant.

If you have already granted this authorization, proceed to Step 4.

1. In Azure, check the Consent on behalf of your organization box.
2. Select Accept.

Azure registers the application in your tenant and redirects you to CloudZero.

Step 4: Grant CloudZero read access to your billing data

The EnrollmentReader role cannot be assigned through the Azure Portal. You can use the CloudZero PowerShell script (Option A) or assign the role through Azure's REST API (Option B).

You must have the Billing Account Owner role on the billing account to assign the EnrollmentReader role to the CloudZero application.

Option A: Use the CloudZero PowerShell script

1. Open a PowerShell session. You can use Azure Cloud Shell (select PowerShell if prompted) or run PowerShell locally. If running locally, install the Azure PowerShell module and sign in with Connect-AzAccount.

2. Download the script:

   • Cloud Shell or command line: Run the following command:
     PowerShell

     Invoke-WebRequest -Uri "https://raw.githubusercontent.com/Cloudzero/provision-account/develop/azure/cz_azure_billing_permissions_setup.ps1" -OutFile "./cz_azure_billing_permissions_setup.ps1"

   • Manual download: Download the script from the CloudZero provision-account repository and place it in your working directory. For full usage details, see the README.

3. Run the script with the billing account ID you copied in Step 1:

   PowerShell

   ./cz_azure_billing_permissions_setup.ps1 -BillingAccountId <your-billing-account-id>

4. Proceed to Step 5.

Option B: Assign the role using the Azure REST API

Because the EnrollmentReader role is not available in the Azure Portal, this method uses Azure's interactive REST API documentation to assign the role.

Get the CloudZeroPlatform Object ID

1. In the Azure Portal, navigate to Enterprise applications.
2. Select the CloudZeroPlatform application.
3. On the Overview page, in the Properties section, copy the Object ID for use in a later step.

Assign the EnrollmentReader role

1. Open the Role Assignments - Put page in Azure's REST API documentation. This page provides an interactive form that lets you assign billing roles by sending requests directly to Azure's API.
2. Select the Try it button to open the interactive request form.

3. Sign in with your account credentials to the tenant with the enrollment access you want to assign.

4. In the Parameters section, enter the following values:

   Parameter	Value
   billingAccountName	The 8-digit billing account ID from Step 1
   billingRoleAssignmentName	A randomly generated GUID (see note below)
   api-version	2019-10-01-preview

   Generating a GUID for billingRoleAssignmentName: Azure uses this value as a unique name for the role assignment. No specific value is required; any valid GUID works. Generate one using a tool like the Online GUID Generator, or run New-Guid in PowerShell. Copy your generated GUID and paste it into the field.

5. Copy the following JSON and paste it into the Body section, replacing the three placeholders:

   JSON

   {
     "properties": {
       "principalId": "{YOUR-OBJECT-ID}",
       "principalTenantId": "{YOUR-TENANT-ID}",
       "roleDefinitionId": "/providers/Microsoft.Billing/billingAccounts/{YOUR-BILLING-ACCOUNT-ID}/billingRoleDefinitions/24f8edb6-1668-4659-b5e2-40bb5f3a7d7e"
     }
   }

   Placeholder	Replace with
   {YOUR-OBJECT-ID}	The CloudZeroPlatform Object ID copied above
   {YOUR-TENANT-ID}	The tenant ID from Step 1
   {YOUR-BILLING-ACCOUNT-ID}	The 8-digit billing account ID from Step 1

   The value 24f8edb6-1668-4659-b5e2-40bb5f3a7d7e is the role definition ID for the EnrollmentReader role.

6. Verify that the Request Preview URL matches this format:

   https://management.azure.com/providers/Microsoft.Billing/billingAccounts/{billingAccountName}/billingRoleAssignments/{billingRoleAssignmentName}?api-version=2019-10-01-preview

7. Select Run. A 200 OK response confirms the role was assigned successfully.

If you receive an error, see Azure's troubleshooting documentation.

Step 5: Verify the connection

1. In CloudZero, go to Settings > Cloud Connections.
2. Select the newly created Azure connection in the Billing Connections table.

On the connection details page, you can see the connection status, tenant ID, billing account ID, agreement type, and ingestion timestamps.

What to expect

After CloudZero processes the first data ingest, the connection status changes from Pending Data to Healthy. This can take several hours. Cost data appears in the Explorer within a day.

You can connect additional Azure accounts at any time by repeating this process. CloudZero supports organizations with multiple tenants.

Once your billing connection is active, you can also connect resource metadata for deeper cost analysis.

If your organization is migrating to a Microsoft Customer Agreement, see Migrating from an Enterprise Agreement on the MCA page.