Azure Foundry

Connect one or more individual Azure subscriptions to OneLens for FinOps visibility, cost analysis, and optimization — using a read-only App Registration and Cost Management exports.

TL;DR

• What this does: Gives OneLens read-only access to your Azure cost and usage data so it can deliver cost visibility, anomaly detection, and right-sizing recommendations across your subscriptions.

• Time required: ~30–45 minutes for a fresh setup; ~10 minutes if Azure is already connected and you're adding a subscription.

• Who you need: A user with the Owner role on each subscription being integrated (to create the App Registration, assign RBAC roles, and configure exports).

• What OneLens reads: Billing/cost-management metadata, resource inventory metadata (via the Reader role), and the Cost Management export files written to your storage account. Your application data, secrets, key contents, and workload payloads are never accessed.

What You'll Get Once Connected

Capability	What it does for you
Unified Cost Explorer	Single view of actual and amortized spend across all integrated subscriptions.
Resource Right-Sizing	Flags over-provisioned VMs, disks, and other resources based on cost and usage metadata.
Cost Allocation by Tag	Groups spend by business unit, environment, or team using billing, resource group, and subscription tags (with tag inheritance enabled).
Anomaly Detection	Surfaces unexpected cost spikes against historical baselines.
Budget Tracking	Tracks spend against budgets and alerts when thresholds are approached.
Idle Resource Detection	Identifies unused or underutilized resources that can be stopped or deleted.
AKS / Kubernetes Cost Insights	Breaks down container costs per cluster, namespace, and workload when AKS cost analysis is enabled.
Storage Cost Insights	Highlights redundant, over-replicated, or low-access-tier storage spend.

Security at a Glance

Question	Answer
Does OneLens read our production or application data?	No. OneLens reads cost/billing metadata, resource inventory metadata, and the exported Cost Management files only. It has no access to the contents of your VMs, databases, or application workloads.
Is access read-only?	Yes. The App Registration and external reader are granted only Reader, Cost Management Reader, Billing reader/Billing account reader, and Storage Blob Data Reader. No write, delete, or management roles are granted.
What authentication is used?	An Azure App Registration (Service Principal) with a client secret, plus an invited external reader identity. Credentials are scoped to the integrated subscriptions only.
How is data transmitted and stored?	All Azure API and blob access is over TLS. Cost exports are stored encrypted at rest in your own storage account (LRS). OneLens stores your client secret encrypted.
Can I restrict access?	Yes. Roles are scoped per subscription and to the single storage account/container used for exports. You control which subscriptions and resource groups are onboarded.
Does enabling network access bypass RBAC?	No. Setting the storage account network --default-action Allow controls network-level access only. Entities still require valid credentials and role assignments to read data.

---

Cost of the Integration

OneLens does not deploy any compute or paid services into your environment. The only Azure resources created are a storage account and a resource group (onelens-rg) to hold Cost Management export files. Costs are limited to storing and writing those export files.

Item	What it is	Typical cost
Compute	None — OneLens runs no compute in your tenant.	$0
Cost Management exports	Scheduled daily export of actual + amortized cost data. Exports themselves are free; you pay only for the resulting storage.	$0 (export feature)
Blob storage	Parquet export files in a Standard LRS account. Volume depends on subscription size; typically a few GB.	~$0.02–$0.50/month
Data egress	OneLens reads exports and API metadata. Egress for metadata reads is negligible.	<$0.05/month
Estimated total	Sum of above	~$0.05–$0.55/month per subscription

Costs scale with the number of resources and the volume of cost records. For very large subscriptions, storage may reach a few dollars per month. Standard LRS is the lowest-cost redundancy option and is recommended.

How It Works

OneLens connects to Azure using an App Registration (Service Principal) that you create in Microsoft Entra ID. You assign read-only billing and resource roles to this service principal (and to a OneLens-provided external reader identity) scoped to the subscriptions you want to onboard.

OneLens collects data from two sources:

1. Azure Cost Management exports — You configure a daily export of actual and amortized cost/usage data (in Parquet format) to a storage account in your tenant. OneLens reads these files via the Storage Blob Data Reader role.

2. Azure Resource Manager + Cost Management APIs — Using the Reader and Cost Management Reader roles, OneLens reads resource inventory metadata and cost data to power right-sizing, anomaly detection, and allocation.

Optionally, enabling AKS cost analysis and tag inheritance enriches the data with per-cluster container costs and inherited tags for accurate cost allocation.

Azure Integration

Prerequisites

• The user performing the integration must have the Owner role on each subscription being integrated.

• The following resource providers must be enabled on the subscriptions in the management groups being onboarded:

  • Microsoft.CostManagementExports

  • Microsoft.CostManagement

  • Microsoft.Billing

  • Microsoft.Storage

• Know your Azure billing account type. Three types are supported, and only the IAM billing-permission step differs between them:

  • Microsoft Online Services Program / Pay-as-you-go (MOSP / PayGo)

  • Microsoft Customer Agreement (MCA)

  • Microsoft Enterprise Agreement (EA)

• Azure CLI installed (required for the storage network update and optional AKS steps).

What OneLens will access

• Cost Management & Billing data — via Billing reader / Billing account reader and Cost Management Reader, to read spend by resource, service, and tag.

• Resource inventory metadata — via the subscription Reader role, to power right-sizing and idle-resource detection.

• Cost export files — via Storage Blob Data Reader on the single storage account holding the exports.

What OneLens will NOT access

• ❌ The contents of your VMs, databases, storage objects (other than the export container), or application workloads.

• ❌ Any write, modify, or delete capability — all roles granted are read-only.

• ❌ Secrets, keys, or certificate material stored in your tenant.

• ❌ Subscriptions, resource groups, or storage accounts you do not explicitly onboard.

Already have Azure connected to OneLens? If you've already onboarded another subscription, a management group, or a billing account, the App Registration (onelens-sa), client secret, storage account, cost exports, and OneLens external user already exist. You do not need to recreate them — skip to Path B: Existing Azure Integration and just extend access to the new subscription(s).

Prefer an automated setup? OneLens also supports a seamless automated integration using Terraform, which provisions the App Registration, storage account, exports, and IAM roles for you.

Path A: Fresh Setup (No Existing Azure Integration)

If this is your first OneLens Azure connection, follow the full step-by-step guide:

➡️ OneLens — Connecting to Azure at Subscription Level

That guide walks through:

1. Creating the App Registration (onelens-sa) and copying the Client ID and Tenant ID.

2. Generating a client secret and copying its Value and ID.

3. Assigning billing permissions to the App Registration (Billing account reader for MCA/MOSP/PayGo, or Billing reader for EA).

4. Creating a storage account (onelens-rg resource group) and container (onelens-cost-usage-reports), and enabling Cost Management exports (actual + amortized, Parquet).

5. Assigning Azure RBAC roles to the App Registration (Reader, Cost Management Reader per subscription; Storage Blob Data Reader on the storage account).

6. Assigning Azure RBAC roles to the OneLens external user (onelens.finops+<customername>@astuto.ai).

7. Updating the storage account network default action (az storage account update ... --default-action Allow).

8. (Optional) Enabling AKS cost analysis.

9. (Optional) Enabling tag inheritance.

When you've finished those steps, continue to Connect to OneLens below to hand off the connection values.

Path B: Existing Azure Integration

If your Azure environment is already connected to OneLens (at another subscription, a management group, or a billing account), the App Registration (onelens-sa), client secret, storage account, cost exports, and OneLens external user are already in place. You only need to extend read-only access to the new subscription. Do not recreate identities or storage.

1

Confirm the required resource providers are registered on the new subscription.

for ns in Microsoft.CostManagementExports Microsoft.CostManagement Microsoft.Billing Microsoft.Storage; do
  az provider register --namespace $ns --subscription <newSubscriptionId>
done

2

Assign Reader and Cost Management Reader on the new subscription

Assign Reader and Cost Management Reader on the new subscription to both the App Registration (onelens-sa) and the OneLens external user (onelens.finops+<customername>@astuto.ai).

For each identity: open Subscriptions → select the new subscription → Access Control (IAM) → + Add → Add role assignment → assign Reader, then repeat for Cost Management Reader. The existing Storage Blob Data Reader grants on the shared storage account still apply, so no storage-account change is needed.

3

Add the new subscription to a cost export.

If the existing export does not cover the new subscription, create a new export scoped to it (Cost Management + Billing → Exports), pointing at the same storage account and container (onelens-cost-usage-reports).

4

Enable AKS cost analysis and tag inheritance

(Optional) Enable AKS cost analysis and tag inheritance for the new subscription.

5

Continue to Connect to OneLens

Share only the new Subscription ID — the App Registration, secret, storage account, and container are unchanged.

Connect to OneLens

Once your chosen path is complete, share the following values with the OneLens team (via email to [e-mail] or through the OneLens dashboard) to finish the connection:

Field	Where to find it
App Registration Tenant (Directory) ID	Entra ID → App registrations → onelens-sa overview
App Registration Client (Application) ID	Entra ID → App registrations → onelens-sa overview
App Registration Client Secret Value	Entra ID → App registrations → onelens-sa → Certificates & secrets
App Registration Client Secret ID	Entra ID → App registrations → onelens-sa → Certificates & secrets
Storage Account name	The storage account holding the exports (onelens-<customername>-billing)
Container name	onelens-cost-usage-reports
Subscription ID(s) / Resource Group ID(s) / Management Group ID(s)	The scopes you onboarded

Existing integration? If Azure is already connected, you only need to share the new Subscription ID — all other values are unchanged.

Verification: After OneLens confirms the connection (typically within 24–48 hours, once the first export has run), check the OneLens dashboard for:

• Cost data appearing in the Cost Explorer for each onboarded subscription.

• Resource inventory populated for right-sizing recommendations.

• AKS cost breakdowns (if AKS cost analysis was enabled).

Data Refresh Schedule

• Cost & usage data: Azure Cost Management exports run daily; OneLens ingests the latest export files once per day. Daily cadence matches Azure's own export frequency and keeps storage cost minimal — polling more often does not surface fresher data.

• Resource metadata: Refreshed daily via the Azure Resource Manager APIs.

Current-period (month-to-date) figures may shift until the billing period closes and amortized costs are finalized.

Data Privacy & Security

• ✅ Read-only access — only Reader, Cost Management Reader, Billing reader/Billing account reader, and Storage Blob Data Reader roles are granted.

• ✅ Restricted scope — access is limited to the subscriptions you onboard and the single export storage account/container.

• ✅ No application data — OneLens reads cost and resource metadata and export files only; it never reads VM, database, or workload contents.

• ✅ TLS in transit, encrypted at rest — all API/blob access is over TLS; exports are stored encrypted in your own storage account.

• ✅ No write capability — no role grants write, modify, or delete permissions.

• ✅ Credentials stored encrypted — your client secret is stored encrypted by OneLens and can be rotated at any time.

• ✅ Network access does not bypass RBAC — --default-action Allow affects network rules only; valid credentials and role assignments are still required.

Troubleshooting

#	Symptom	Cause	Fix
1	"Authorization failed" when assigning roles	The signed-in user lacks Owner on the subscription.	Have a subscription Owner perform the role assignments, or request the Owner role.
2	App registration not found when adding a member	onelens-sa was created in a different tenant or hasn't propagated.	Confirm you are in the correct tenant and search by the exact name onelens-sa.
3	Client secret authentication fails	The secret Value was mistyped, expired, or you shared the ID instead of the Value.	Generate a new secret, copy the Value immediately, and re-share with OneLens.
4	No export files appear in the container	The export was scoped to the wrong subscription, or the first run hasn't completed.	Verify the export Scope and destination; wait up to 24 hours for the first run.
5	OneLens cannot read export files	Storage Blob Data Reader not assigned, or network default action is Deny.	Assign Storage Blob Data Reader and run az storage account update ... --default-action Allow.
6	Connected but no cost data after 24–48 hours	Missing Cost Management Reader role or resource providers not registered.	Confirm both Reader and Cost Management Reader are assigned and the four resource providers are registered.
7	AKS cost analysis command fails	Cluster is on the Free tier or required providers aren't registered.	Move the cluster to Standard/Premium and register Microsoft.ContainerService, Microsoft.Insights, Microsoft.OperationalInsights.
8	Costs not grouped by team/tag	Tag inheritance not enabled.	Enable tag inheritance.

Frequently Asked Questions

Can OneLens see our application data, VM contents, or database records?

No. OneLens reads cost/billing metadata, resource inventory metadata, and the Cost Management export files only. It has no access to the contents of your workloads.

Can OneLens modify or delete anything in our Azure environment?

No. Every role granted (Reader, Cost Management Reader, Billing reader/Billing account reader, Storage Blob Data Reader) is read-only. No write, modify, or delete permissions are assigned.

Why does OneLens need access via both an App Registration and an external user?

The App Registration (service principal) provides programmatic, automated access for ongoing data collection, while the invited external reader supports OneLens-side connection workflows. Both are read-only and scoped to the subscriptions you onboard.

Will this impact our Azure performance or bills?

No measurable performance impact. The only added cost is storing the daily export files (typically cents to a few dollars per month). OneLens runs no compute in your tenant.

Can I onboard multiple subscriptions?

Yes. For each additional subscription, follow Path B to extend Reader and Cost Management Reader access. A single export storage account can be reused.

How do I rotate the client secret?

In Entra ID → App registrations → onelens-sa → Certificates & secrets, create a new secret, copy its Value, share it with OneLens, then delete the old secret.

How do I disconnect OneLens?

Remove the role assignments for onelens-sa and the OneLens external user from each subscription and the storage account, delete the client secret (or the onelens-sa app registration entirely), and optionally delete the export and onelens-rg resource group. Notify OneLens so the connection is removed on their end.

Does enabling `--default-action Allow` make my storage account public?

No. It changes network-rule behavior only. Reading data still requires valid credentials and the Storage Blob Data Reader role.

Need Help?

OneLens Documentation:

• Connecting to Azure (overview)

• Connect at Subscription Level (full step-by-step)

• Automated integration using Terraform

• Connect at Management Group

Azure Documentation:

• Create a Microsoft Entra application and service principal

• Create exports with Cost Management

• Assign Azure roles using the portal

• Enable tag inheritance

OneLens Support: [e-mail]

---

Reference sources: OneLens — Connecting to Azure at Subscription Level · OneLens — Connecting to Azure (overview) · OneLens — Automated using Terraform · Azure Cost Management exports · Azure RBAC role assignments