Skip to main content

Azure Account Onboarding Overview

Welcome to the CloudYali Azure Account Onboarding Guide! This document serves as an overview of onboarding for Microsoft Azure accounts.

CloudYali uses Service Principals to securely access and manage data from your Azure subscriptions, allowing read-only access for cost management and anomaly detection. This guide will link you to the detailed instructions for each account type.

note

Microsoft renamed "Azure Active Directory" to "Microsoft Entra ID" in 2023. If you see references to "Azure AD" in the Azure portal or in CLI commands, they refer to the same service.

Supported Azure Account Types​

CloudYali supports all major Azure account types:

Account TypeBest ForSetup Complexity
Pay-as-You-Go (PAYG)Startups, small teamsSimple
Microsoft Customer Agreement (MCA)Growing businessesMedium
Enterprise Agreement (EA)Large enterprisesMedium

Overview of Onboarding Options​

1. Azure Cost Management Setup​

This onboarding method helps you set up Cost Management Exports by connecting your cost data with CloudYali. This allows you to track and manage cloud costs using daily cost exports to Azure Storage.

  • Who Should Use This? Use this option if you need detailed cost tracking and analysis for your Azure resources.

  • Features:

    • Set up a Service Principal with minimal permissions.
    • Configure Cost Management Exports to Azure Storage Account.
    • Monitor cloud spend for your Azure subscriptions.
    • Receive automatic cost anomaly detection.
    • Track usage by resource, location, and tags.

For detailed instructions, please refer to the Azure Cost Management Setup Guide.

How CloudYali Connects to Azure​

CloudYali uses Azure Cost Management Exports to ingest your cost data. Here's why this approach matters:

Instead of polling the Azure Cost Management API directly (which is subject to rate limits and can miss data during API outages), CloudYali reads cost data from daily CSV exports that Azure generates and stores in your own Azure Storage Account.

This architecture gives you three advantages:

  1. Your data stays in your tenant — Cost exports live in your Azure Storage Account. CloudYali reads them with read-only access. You control retention, encryption, and access policies.

  2. Reliable and complete data — Azure generates exports on a fixed schedule regardless of API availability. No data gaps from throttling or transient API errors.

  3. Full cost visibility — Exports include the complete cost dataset: actual costs, amortized costs, usage details, tags, and resource metadata.

What this means for setup: You'll need to create a Storage Account and configure a Cost Management Export (Steps 3-4 below) in addition to the Service Principal. This takes an extra 5-10 minutes but ensures reliable, enterprise-grade data ingestion.

Setup workflow and post-setup data flow​

Setup workflow and post-setup data flow — shows the 8-step onboarding process from initializing setup in CloudYali through creating an App Registration, collecting credentials, assigning RBAC roles, creating storage, configuring cost exports, and validating the connection. Also shows the post-setup data flow where Azure Cost Management writes daily CSVs to the Blob Container and CloudYali reads them via the Service Principal.

How Azure entities relate​

How Azure entities relate — shows the Identity Plane (App Registration with Client ID, Tenant ID, Client Secret) and Resource Plane (Subscription containing Resource Group, Storage Account, and Blob Container). RBAC Role Assignments bridge the two planes: Reader role on Subscription and Storage Blob Data Reader on Storage Account. CloudYali Platform authenticates as the Service Principal and reads cost exports from the Blob Container.

Security Considerations​

Key Security Benefits:​

  • Service Principal Security: CloudYali uses a dedicated Service Principal for Azure integration, ensuring that CloudYali has access only to the necessary data for cost management.
  • Minimal Permissions: CloudYali uses only Reader (PAYG/EA) or Billing Account Reader (MCA) roles - never requesting WRITE permissions.
  • Encrypted Credentials: Service Principal credentials are encrypted with AES-256 and stored in AWS Secrets Manager, never in the application database.
  • Read-Only Access: CloudYali can only read cost and usage data; it cannot create, modify, or delete any Azure resources.
  • Storage Security: Cost exports are stored in Azure Blob Storage with private access; CloudYali uses Storage Blob Data Reader role for read-only access.

General Onboarding Steps​

Step 1: Log in to CloudYali Console​

  • Navigate to your CloudYali portal (e.g., https://portal.cloudyali.com)
  • Click Settings in the main menu
  • Click Integrations
  • Click + Connect Azure

Step 2: Choose Your Azure Account Type​

CloudYali will guide you to select your account type:

  • Pay-as-You-Go (PAYG)
  • Microsoft Customer Agreement (MCA)
  • Enterprise Agreement (EA)

Not sure which account type you have?​

The most reliable way to check is directly in the Azure portal:

  1. Go to Azure Portal → Cost Management + Billing
  2. Click Billing scopes in the left menu
  3. Select your billing account
  4. Look at the Account type field on the properties page
What you seeYour account typeCloudYali setup
Account type: Microsoft Customer AgreementMCAMCA setup instructions
Account type: Enterprise AgreementEAEA setup instructions
No billing account visible, only subscriptionsPAYGPAYG setup instructions

For detailed instructions from Microsoft, see Check the type of your account.

note

If you're on a Cloud Solution Provider (CSP) agreement, please contact support@cloudyali.io for assistance. CSP accounts use a different billing model.

Step 3: Create a Service Principal​

Create a Service Principal in Azure with appropriate permissions for your account type:

  • PAYG: Requires Reader role at subscription level
  • MCA: Requires Billing Account Reader role at billing account level
  • EA: Requires Reader role at Management Group level, or Enrollment Reader at enrollment scope

For detailed instructions, refer to Creating an Azure Service Principal.

Step 4: Configure Cost Management Exports​

Set up daily cost exports from Azure to a Storage Account:

  1. Create an Azure Storage Account
  2. Create a Blob container for cost exports
  3. Configure Cost Management Export with daily schedule
  4. Grant Service Principal access to the storage account

For detailed instructions, refer to Configuring Cost Management Exports.

Step 5: Add Account to CloudYali​

In the CloudYali portal, fill in:

  • Account Name: Friendly name (e.g., "Production")
  • Account Type: PAYG / MCA / EA
  • Subscription ID: Your Azure subscription ID
  • Tenant ID: Your Microsoft Entra ID tenant ID
  • Client ID: Service Principal application ID
  • Client Secret: Service Principal password
  • Storage Account Name: Name of your storage account
  • Container Name: Name of blob container (e.g., cost-exports)
  • Export Name: Name of your cost export

Step 6: Save Configuration​

  • Click Save or Connect
  • CloudYali will begin syncing your cost data automatically
  • Data will be available within 24 hours

Multi-Subscription Setup​

If your organization has multiple Azure subscriptions, you have two options for connecting them to CloudYali:

Assign the Service Principal Reader role at the Management Group level. This automatically grants access to all subscriptions under that management group — including any new subscriptions added in the future.

# Get your Management Group ID
az account management-group list --query "[].{Name:name, Id:id}" -o table

# Assign Reader at Management Group level
az role assignment create \
  --assignee <SERVICE_PRINCIPAL_APP_ID> \
  --role "Reader" \
  --scope "/providers/Microsoft.Management/managementGroups/<MANAGEMENT_GROUP_ID>"

Advantages:

  • New subscriptions are automatically included
  • Single role assignment covers all subscriptions
  • No per-subscription maintenance

Cost Management Export: You'll still need one export per subscription (Azure limitation). Configure exports in each subscription pointing to the same Storage Account and Container. Use the directory field to organize by subscription:

cost-exports/
├── subscription-prod/
├── subscription-staging/
└── subscription-dev/

Option B: Per-Subscription Scope​

Assign the Service Principal Reader role on each subscription individually. Use this when you want to include only specific subscriptions.

# Repeat for each subscription
az role assignment create \
  --assignee <SERVICE_PRINCIPAL_APP_ID> \
  --role "Reader" \
  --scope "/subscriptions/<SUBSCRIPTION_ID_1>"

az role assignment create \
  --assignee <SERVICE_PRINCIPAL_APP_ID> \
  --role "Reader" \
  --scope "/subscriptions/<SUBSCRIPTION_ID_2>"

Remember: When adding a new subscription later, you must:

  1. Assign the Reader role on the new subscription
  2. Configure a Cost Management Export for the new subscription
  3. Grant Storage Blob Data Reader on the storage account (if using a per-subscription storage account)

Shared vs Separate Storage Accounts​

ApproachWhen to use
One shared Storage AccountMost setups. Simpler to manage. Use directory prefixes to organize by subscription.
Separate Storage Accounts per subscriptionWhen subscriptions are in different regions and you want data locality, or when different teams own different subscriptions.

Both approaches work with CloudYali. Enter all storage details when adding accounts in the CloudYali console.

Data Sync Timeline​

After connecting your Azure account:

TimeframeWhat Happens
0-24 hoursInitial data retrieval and processing begins
24+ hoursCost data becomes available in dashboards
7+ daysAnomaly detection baseline is established
DailyNew cost data available (typically by 8 AM UTC)
Currency

Azure Cost Management Exports include costs in the billing currency of your subscription (e.g., INR for India-based subscriptions, USD for US-based). CloudYali preserves the original billing currency in reports. If you have subscriptions billed in different currencies, CloudYali converts and displays all costs in USD for consistent cross-cloud reporting.

Account Type Prerequisites​

Pay-as-You-Go (PAYG)​

  • No special prerequisites
  • Service Principal needs Reader role on subscription
  • Simple setup, typically 15-20 minutes

Microsoft Customer Agreement (MCA)​

  • "Azure charges" setting must be enabled at billing account level
  • Service Principal needs Billing Account Reader role at billing account scope
  • Verify in: Cost Management + Billing → Billing account properties

Enterprise Agreement (EA)​

  • Enterprise Admin must enable "Account Owner (AO) view charges" at enrollment level
  • Service Principal needs Reader role at Management Group level, or Enrollment Reader at enrollment scope
  • Contact your Enterprise Admin if this isn't enabled

Permissions Reference​

For a complete list of required permissions and what CloudYali can and cannot access, refer to the Azure Permissions Reference.

Troubleshooting​

Common Issues​

Authentication Failed

  • Verify Client ID, Tenant ID, and Client Secret are correct
  • Check if Client Secret has expired
  • Confirm Service Principal exists in Microsoft Entra ID
  • Wait 5-10 minutes for role assignments to propagate

Cannot Access Storage

  • Verify Service Principal has "Storage Blob Data Reader" role
  • Check storage account name and container name match CloudYali configuration
  • Ensure cost exports are being generated in Cost Management

No Cost Data Available

  • Wait 24 hours for initial data sync
  • Verify cost management export is configured and running
  • Check export frequency is set to "Daily"

For more troubleshooting, refer to the complete Azure Cost Management Setup Guide.

Rotating Your Client Secret​

Azure client secrets expire based on the expiration you set during creation (recommended: 12 or 24 months). You must rotate the secret before it expires to avoid data sync interruptions.

Step 1: Generate a New Secret in Azure​

  1. Go to Azure Portal
  2. Navigate to Microsoft Entra ID → App registrations
  3. Select your CloudYali-Billing app
  4. Go to Certificates & secrets
  5. Click + New client secret
  6. Set description: CloudYali Integration (rotated YYYY-MM-DD)
  7. Set expiration: 12 months / 24 months
  8. Click Add and copy the new secret Value immediately
caution

The secret value is shown only once. If you navigate away without copying it, you'll need to create another new secret.

Step 2: Update the Secret in CloudYali​

  1. Log in to CloudYali Console
  2. Go to Settings → Cloud Accounts
  3. Find your Azure account and click Edit
  4. Update the Client Secret field with the new value
  5. Click Save

Step 3: Verify the Connection​

After updating:

  • CloudYali will use the new secret on the next sync cycle
  • Verify data is flowing by checking the account status (should show "Connected")
  • If the status shows an error, wait 5-10 minutes for Azure role propagation

Once you've confirmed the new secret works:

  1. Go back to Certificates & secrets in Azure
  2. Find the old secret and click Delete

Setting a Reminder​

We recommend setting a calendar reminder 30 days before your secret expires. You can find the expiry date in:

  • Azure Portal: Microsoft Entra ID → App registrations → CloudYali-Billing → Certificates & secrets
  • CloudYali Console: Settings → Cloud Accounts → your Azure account details
tip

Consider using Azure Key Vault with automatic rotation for production environments. This eliminates manual secret rotation entirely.

Next Steps​

Once your Azure account is connected:

  1. Wait for Baseline (7-14 days)

    • CloudYali needs 7+ days of data to establish cost baselines
    • Anomaly detection becomes more accurate over time

  2. Set Up Budgets (Optional)

    • Go to Budgets → + Create Budget
    • Set monthly/weekly budget thresholds

  3. Configure Notifications (Optional)

    • Go to Settings → Notifications
    • Set up Email or Microsoft Teams alerts

  4. Tag Resources (Recommended)

    • Tag Azure resources with Environment, Team, Project, etc.
    • CloudYali uses tags for cost allocation and anomaly analysis

Need Help?​

If you encounter any issues or need more assistance:

Response Times:

  • Email support: Within 24 hours
  • Live chat: Immediate during business hours
  • Critical issues: Within 4 hours
Last updated on