Azure service principal for CloudYali

CloudYali signs in to Microsoft Azure as a service principal: an app registration in Microsoft Entra ID with a client secret. This page creates it and assigns its roles; you then connect Azure in CloudYali. It takes about 10 minutes.

Before you start

• You need permission to create app registrations in Microsoft Entra ID, and to assign roles on the subscription and the export's storage account (Owner or User Access Administrator).
• Create the Cost Management export first, so you know its storage account.

Create the app registration and secret

1. In the Azure portal, open Microsoft Entra ID → App registrations and select New registration.
2. Enter a name, such as cloudyali-reader, keep the default account type, and select Register.
3. On the app's Overview, copy the Application (client) ID and the Directory (tenant) ID.
4. Open Certificates & secrets → Client secrets and select New client secret.
5. Choose an expiry and select Add.
6. Copy the secret's Value. Azure shows it only once; the Secret ID next to it is not the secret.

Note the expiry date. CloudYali stops reading cost when the secret expires, and the console cannot replace it yet, so plan the change with support@cloudyali.io before then.

Assign the roles

1. Open the export's storage account, then Access control (IAM) → Add → Add role assignment.
2. Choose Storage Blob Data Reader and select Next.
3. Add the app as a member, then select Review + assign.
4. Open each subscription CloudYali should cover and assign the Reader role to the app the same way.
5. Optionally, assign Monitoring Reader on the same subscriptions for CloudYali's rightsizing rules.

With the Azure CLI, the same roles are:

APP_ID=<application-client-id>
az role assignment create --assignee "$APP_ID" --role "Storage Blob Data Reader" \
  --scope "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>"
az role assignment create --assignee "$APP_ID" --role "Reader" --scope "/subscriptions/<subscription-id>"

Role assignments take five to ten minutes to apply.

Check that it worked

Connect Azure in CloudYali. The console checks the secret and the storage access straight away and shows Connected when both work.

Troubleshooting

Symptom	Cause	Fix
You are signed out of CloudYali when you select Connect	The secret's ID was pasted instead of its value, or the tenant ID is wrong	Sign in again, create a new secret and paste its value
Missing Storage Blob Data Reader role	The role is on the subscription or resource group instead of the storage account, or is still applying	Assign it on the storage account and wait ten minutes
No resources in Resource Inventory	The app has no Reader role on the subscription	Assign Reader on each subscription