--- title: Azure Cost and Usage Integration slug: azure-cost-and-usage-integration docTags: createdAt: 2025-02-17T16:19:41.875Z --- # Prerequisites These steps are specifically for the Azure Cost and Usage integration. This integration currently requires approval from SHI in advance. To perform the following steps, the user executing them must have: - **Application Administrator** role at the scope where the role assignment is being made (in this case, the root scope `/`) to assign roles to the service principal (Step 3) - An **Azure CLI** environment; we recommend using the **Cloud Shell** available in the Azure Portal to run the az cli commands ## Permissions Required We request the following permissions to be assigned to our application: | **Role** | **Scope** | **Purpose** | | --------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Cost Management Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#cost-management-contributor) | Root Tenant Scope | **Cost Management Contributor at the Root Tenant Scope**
1) Retrieve a list of your subscriptions attached to that tenant scope. 2) Schedule Cost & Usage reports for each subscription individually. 3) Detect new subscriptions and auto-configure Cost & Usage Exports.
*Note: While Cost Management Contributor also has access to Create/Update/Delete Budgets, that is not the purpose of this application and those permissions will not be used.* | | [Storage Account Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-account-contributor) | Designated Storage Account | **Storage Account Contributor for a single Storage Account created for Cost & Usage Data Exports**
A storage account specifically created for cost & usage exports will be managed by our application, including configuring the storage retention policy to keep data storage costs minimal. Currently we use hot storage for 7 days, cold storage for 30 days, then deletion. | :::hint{type="danger"} This storage account must be dedicated for our use, do NOT use this storage account for any other purpose, as our retention policies will apply to those files. ::: # Step-by-Step Instructions You will require access to both the **Azure Portal** and the **Azure CLI** to execute these commands. ## 1. Create a Storage Account [Create a Storage Account](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal) inside your root tenant - this will be used for the data exports. Copy the storage account name as you'll need it for a later step. We require this to be a new storage account, as the roles required to manage the creation of data exports and create file lifecycle policy will give full access to this storage account. ## 2. Validate your Current Tenant From the Azure Portal Shell (bash), run the following command to validate you're currently active under the tenant you intend to grant access for: ```bash az account list --query "[?isDefault].{tenantId: tenantId, name: name}" ``` Keep track of this tenantId for future steps, as well as providing this data back to us. ## 3. Create a Service Principal for Our Application Run the following command to create a service principal for our application using its application ID: ```bash az ad sp create --id 6b2205ef-191b-4e4a-b7dd-31a0059f8abe ``` **Explanation**: This command creates a service principal associated with our application. A service principal is an identity used by applications or services to access Azure resources. By creating this, you establish an identity for our app in your Azure Active Directory (Azure AD). - **Application ID**: `6b2205ef-191b-4e4a-b7dd-31a0059f8abe` is the Application ID for **Catalyst by SHI - Azure Cost and Usage** ## 4. Grant the Service Principal access to your new Storage Account ```bash SCOPE=`az storage account show --name --query "id" | xargs` echo $SCOPE ``` Example: ```bash $ SCOPE=`az storage account show --name --query "id" | xargs` $ echo $SCOPE /subscriptions/XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mynewstorageaccount ``` Save the output provided! We'll need that information in order to configure and retrieve cost and usage data. If you don't see that string, make sure your az command is surrounded by backticks (\`) and not quotes. Now run: ```bash az role assignment create --assignee 6b2205ef-191b-4e4a-b7dd-31a0059f8abe --role 'Storage Account Contributor' --scope $SCOPE ``` This will assign the Storage Account Contributor role to that specific storage account and *only* that storage account. ## 5. Grant the Service Principal access to the Cost Management Contributor Role ```bash az role assignment create --assignee 6b2205ef-191b-4e4a-b7dd-31a0059f8abe --role 'Cost Management Contributor' --scope / ``` **Cost Management Contributor:** The purpose of this role is to allow us to create data exports for subscriptions. By providing this level of access, it reduces the amount of initial setup, and removes the need for ongoing maintenance per subscription - if you add a new subscription to your tenant, we will detect that subscription and start collecting Cost & Usage data for it. ## 6. Provide the "SCOPE" with storage account information back to your SHI Expert Copy the value you saved above in step 4: `/subscriptions/XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mynewstorageaccount` And provide it back to your SHI Expert. There are no secret values or passwords in this string, so it's safe to pass via Email or other methods.