Azure / Technical guide
Why Azure inventory access can work while cost access fails
Seeing a virtual machine in Azure does not establish access to its billing data. The signed-in principal, Azure scope and agreement-level charge settings all influence what a cost query can return.
Diagnose the missing capability first. Granting Contributor to make a read-only integration work introduces write authority without proving that the billing problem has been resolved.
Ask about Azure accessIdentify the principal and the requested scope
Confirm which identity the integration actually uses and which tenant owns the subscription. A human administrator's portal access does not prove that the service principal has equivalent access. Check role assignments on the requested subscription or appropriate parent scope, including inheritance.
Resource scopes and billing scopes have different roles. A billing account, enrollment account and subscription are not interchangeable. Start with the scope the integration documents, rather than granting a parent billing role simply because a subscription query failed.
Confirm identity
Match the configured tenant/application with the principal shown in Azure role assignments. Do not share its secret in a support ticket.
Confirm scope
Check the exact included subscription and relevant inherited role assignments.
Test the capability
Distinguish a failed cost query from a successful empty period and a failed inventory read.
Read roles and agreement policies answer different questions
Reader supports resource inspection at its assigned scope. Cost Management Reader is the purpose-specific read role for cost information. The required combination depends on the data the integration collects and the agreement's policies.
Microsoft documents additional EA charge-visibility settings such as Account owners can view charges. MCA charge access can also depend on billing-profile policies. These settings explain why a role assignment alone may not be enough. A billing owner must review the applicable agreement settings; the integration should not ask for broad write access as a shortcut.
| Observation | Next check |
|---|---|
| Inventory works, costs fail | Cost role, requested scope and agreement charge policy |
| Both fail | Principal, tenant, subscription inclusion and role scope |
| Costs return no rows | Date availability, source freshness and supported offer |
| Metrics are missing | Metric collection/instrumentation and permission coverage |
A validated connection can still be partial
Authentication, billing, inventory and metrics are separate capabilities. A successful token acquisition establishes identity, not that every detector has enough evidence. Retesting should reveal which reads worked and which remained permission-limited or unavailable.
Costframe uses read-only Azure access for supported billing, resource and utilization collection. Missing capability evidence reduces what can be concluded about a resource. Check the setup documentation and connection limitations rather than interpreting one healthy signal as a complete audit.
Prepare a useful access handoff
Record the failing capability, selected scope, test time and safe error category. Note whether the role was recently changed, since propagation can delay access. Do not keep retrying an unchanged configuration or call an access-denied result zero cost.
Costframe does not need authority to resize or delete customer resources. Your administrator applies approved Azure role changes, and your engineering team implements any later optimization actions outside Costframe.
References and further reading
Provider documentation explains native capabilities. Costframe availability and limitations are stated separately in this guide.
Review the read-only setup
Discuss the intended Azure scopes and capability gaps before changing role assignments.
Ask about Azure access