Azure permissions

CloudYali reads Microsoft Azure as a service principal you create, with a client secret. It needs read roles only: one on the storage account that holds the Cost Management export, and one on each subscription for resources and recommendations.

Service principal roles

Role	Scope	Enables	Checked when you connect
Storage Blob Data Reader	The storage account the export writes to	Reading the export files: all Azure cost	Yes
Reader	Each subscription CloudYali should cover	Resource Inventory through Azure Resource Graph, and Azure Advisor cost recommendations in Cost Savings	No
Monitoring Reader	The same subscriptions; optional	CloudYali's own rightsizing rules, which read Azure Monitor metrics. Without it, those rules are skipped	No

CloudYali reads only Advisor's cost recommendations, not its security, reliability or performance ones.

Roles the console names by agreement type

The Connect Azure form names a role for each agreement type:

Agreement type	Role the form names	Where
Pay-as-you-go	Cost Management Reader	The subscription
Microsoft Customer Agreement	Billing Account Reader	The billing account
Enterprise Agreement	Cost Management Reader or Enrollment Reader	The enrollment
CloudYali reads cost from the export files, so the service principal does not need these roles to
show cost. The person who creates the export needs access to Cost Management for that scope.

Agreement prerequisites

Agreement	Setting	Where
Microsoft Customer Agreement	Azure charges set to Yes	Cost Management + Billing → Billing account properties
Enterprise Agreement	Account Owner (AO) view charges turned on	By your Enterprise Admin

Where you see it in CloudYali

The Connected tab of Integrations shows each subscription with its agreement type. To connect one, see Connect Azure.