Azure Foundry
Connect one or more individual Azure subscriptions to OneLens for FinOps visibility, cost analysis, and optimization — using a read-only App Registration and Cost Management exports.
TL;DR
What this does: Gives OneLens read-only access to your Azure cost and usage data so it can deliver cost visibility, anomaly detection, and right-sizing recommendations across your subscriptions.
Time required: ~30–45 minutes for a fresh setup; ~10 minutes if Azure is already connected and you're adding a subscription.
Who you need: A user with the Owner role on each subscription being integrated (to create the App Registration, assign RBAC roles, and configure exports).
What OneLens reads: Billing/cost-management metadata, resource inventory metadata (via the
Readerrole), and the Cost Management export files written to your storage account. Your application data, secrets, key contents, and workload payloads are never accessed.
What You'll Get Once Connected
Unified Cost Explorer
Single view of actual and amortized spend across all integrated subscriptions.
Resource Right-Sizing
Flags over-provisioned VMs, disks, and other resources based on cost and usage metadata.
Cost Allocation by Tag
Groups spend by business unit, environment, or team using billing, resource group, and subscription tags (with tag inheritance enabled).
Anomaly Detection
Surfaces unexpected cost spikes against historical baselines.
Budget Tracking
Tracks spend against budgets and alerts when thresholds are approached.
Idle Resource Detection
Identifies unused or underutilized resources that can be stopped or deleted.
AKS / Kubernetes Cost Insights
Breaks down container costs per cluster, namespace, and workload when AKS cost analysis is enabled.
Storage Cost Insights
Highlights redundant, over-replicated, or low-access-tier storage spend.
Security at a Glance
Does OneLens read our production or application data?
No. OneLens reads cost/billing metadata, resource inventory metadata, and the exported Cost Management files only. It has no access to the contents of your VMs, databases, or application workloads.
Is access read-only?
Yes. The App Registration and external reader are granted only Reader, Cost Management Reader, Billing reader/Billing account reader, and Storage Blob Data Reader. No write, delete, or management roles are granted.
What authentication is used?
An Azure App Registration (Service Principal) with a client secret, plus an invited external reader identity. Credentials are scoped to the integrated subscriptions only.
How is data transmitted and stored?
All Azure API and blob access is over TLS. Cost exports are stored encrypted at rest in your own storage account (LRS). OneLens stores your client secret encrypted.
Can I restrict access?
Yes. Roles are scoped per subscription and to the single storage account/container used for exports. You control which subscriptions and resource groups are onboarded.
Does enabling network access bypass RBAC?
No. Setting the storage account network --default-action Allow controls network-level access only. Entities still require valid credentials and role assignments to read data.
Cost of the Integration
OneLens does not deploy any compute or paid services into your environment. The only Azure resources created are a storage account and a resource group (onelens-rg) to hold Cost Management export files. Costs are limited to storing and writing those export files.
Compute
None — OneLens runs no compute in your tenant.
$0
Cost Management exports
Scheduled daily export of actual + amortized cost data. Exports themselves are free; you pay only for the resulting storage.
$0 (export feature)
Blob storage
Parquet export files in a Standard LRS account. Volume depends on subscription size; typically a few GB.
~$0.02–$0.50/month
Data egress
OneLens reads exports and API metadata. Egress for metadata reads is negligible.
<$0.05/month
Estimated total
Sum of above
~$0.05–$0.55/month per subscription
Costs scale with the number of resources and the volume of cost records. For very large subscriptions, storage may reach a few dollars per month. Standard LRS is the lowest-cost redundancy option and is recommended.
How It Works
OneLens connects to Azure using an App Registration (Service Principal) that you create in Microsoft Entra ID. You assign read-only billing and resource roles to this service principal (and to a OneLens-provided external reader identity) scoped to the subscriptions you want to onboard.
OneLens collects data from two sources:
Azure Cost Management exports — You configure a daily export of actual and amortized cost/usage data (in Parquet format) to a storage account in your tenant. OneLens reads these files via the
Storage Blob Data Readerrole.Azure Resource Manager + Cost Management APIs — Using the
ReaderandCost Management Readerroles, OneLens reads resource inventory metadata and cost data to power right-sizing, anomaly detection, and allocation.
Optionally, enabling AKS cost analysis and tag inheritance enriches the data with per-cluster container costs and inherited tags for accurate cost allocation.
Azure Integration
Prerequisites
The user performing the integration must have the Owner role on each subscription being integrated.
The following resource providers must be enabled on the subscriptions in the management groups being onboarded:
Microsoft.CostManagementExportsMicrosoft.CostManagementMicrosoft.BillingMicrosoft.Storage
Know your Azure billing account type. Three types are supported, and only the IAM billing-permission step differs between them:
Microsoft Online Services Program / Pay-as-you-go (MOSP / PayGo)
Microsoft Customer Agreement (MCA)
Microsoft Enterprise Agreement (EA)
Azure CLI installed (required for the storage network update and optional AKS steps).
What OneLens will access
Cost Management & Billing data — via
Billing reader/Billing account readerandCost Management Reader, to read spend by resource, service, and tag.Resource inventory metadata — via the subscription
Readerrole, to power right-sizing and idle-resource detection.Cost export files — via
Storage Blob Data Readeron the single storage account holding the exports.
What OneLens will NOT access
❌ The contents of your VMs, databases, storage objects (other than the export container), or application workloads.
❌ Any write, modify, or delete capability — all roles granted are read-only.
❌ Secrets, keys, or certificate material stored in your tenant.
❌ Subscriptions, resource groups, or storage accounts you do not explicitly onboard.
Already have Azure connected to OneLens? If you've already onboarded another subscription, a management group, or a billing account, the App Registration (onelens-sa), client secret, storage account, cost exports, and OneLens external user already exist. You do not need to recreate them — skip to Path B: Existing Azure Integration and just extend access to the new subscription(s).
Prefer an automated setup? OneLens also supports a seamless automated integration using Terraform, which provisions the App Registration, storage account, exports, and IAM roles for you.
Path A: Fresh Setup (No Existing Azure Integration)
If this is your first OneLens Azure connection, follow the full step-by-step guide:
➡️ OneLens — Connecting to Azure at Subscription Level
That guide walks through:
Creating the App Registration (
onelens-sa) and copying the Client ID and Tenant ID.Generating a client secret and copying its Value and ID.
Assigning billing permissions to the App Registration (
Billing account readerfor MCA/MOSP/PayGo, orBilling readerfor EA).Creating a storage account (
onelens-rgresource group) and container (onelens-cost-usage-reports), and enabling Cost Management exports (actual + amortized, Parquet).Assigning Azure RBAC roles to the App Registration (
Reader,Cost Management Readerper subscription;Storage Blob Data Readeron the storage account).Assigning Azure RBAC roles to the OneLens external user (
onelens.finops+<customername>@astuto.ai).Updating the storage account network default action (
az storage account update ... --default-action Allow).(Optional) Enabling AKS cost analysis.
(Optional) Enabling tag inheritance.
When you've finished those steps, continue to Connect to OneLens below to hand off the connection values.
Path B: Existing Azure Integration
If your Azure environment is already connected to OneLens (at another subscription, a management group, or a billing account), the App Registration (onelens-sa), client secret, storage account, cost exports, and OneLens external user are already in place. You only need to extend read-only access to the new subscription. Do not recreate identities or storage.
Assign Reader and Cost Management Reader on the new subscription
Reader and Cost Management Reader on the new subscriptionAssign Reader and Cost Management Reader on the new subscription to both the App Registration (onelens-sa) and the OneLens external user (onelens.finops+<customername>@astuto.ai).
For each identity: open Subscriptions → select the new subscription → Access Control (IAM) → + Add → Add role assignment → assign Reader, then repeat for Cost Management Reader. The existing Storage Blob Data Reader grants on the shared storage account still apply, so no storage-account change is needed.
Connect to OneLens
Once your chosen path is complete, share the following values with the OneLens team (via email to support@astuto.ai or through the OneLens dashboard) to finish the connection:
App Registration Tenant (Directory) ID
Entra ID → App registrations → onelens-sa overview
App Registration Client (Application) ID
Entra ID → App registrations → onelens-sa overview
App Registration Client Secret Value
Entra ID → App registrations → onelens-sa → Certificates & secrets
App Registration Client Secret ID
Entra ID → App registrations → onelens-sa → Certificates & secrets
Storage Account name
The storage account holding the exports (onelens-<customername>-billing)
Container name
onelens-cost-usage-reports
Subscription ID(s) / Resource Group ID(s) / Management Group ID(s)
The scopes you onboarded
Existing integration? If Azure is already connected, you only need to share the new Subscription ID — all other values are unchanged.
Verification: After OneLens confirms the connection (typically within 24–48 hours, once the first export has run), check the OneLens dashboard for:
Cost data appearing in the Cost Explorer for each onboarded subscription.
Resource inventory populated for right-sizing recommendations.
AKS cost breakdowns (if AKS cost analysis was enabled).
Data Refresh Schedule
Cost & usage data: Azure Cost Management exports run daily; OneLens ingests the latest export files once per day. Daily cadence matches Azure's own export frequency and keeps storage cost minimal — polling more often does not surface fresher data.
Resource metadata: Refreshed daily via the Azure Resource Manager APIs.
Current-period (month-to-date) figures may shift until the billing period closes and amortized costs are finalized.
Data Privacy & Security
✅ Read-only access — only
Reader,Cost Management Reader,Billing reader/Billing account reader, andStorage Blob Data Readerroles are granted.✅ Restricted scope — access is limited to the subscriptions you onboard and the single export storage account/container.
✅ No application data — OneLens reads cost and resource metadata and export files only; it never reads VM, database, or workload contents.
✅ TLS in transit, encrypted at rest — all API/blob access is over TLS; exports are stored encrypted in your own storage account.
✅ No write capability — no role grants write, modify, or delete permissions.
✅ Credentials stored encrypted — your client secret is stored encrypted by OneLens and can be rotated at any time.
✅ Network access does not bypass RBAC —
--default-action Allowaffects network rules only; valid credentials and role assignments are still required.
Troubleshooting
1
"Authorization failed" when assigning roles
The signed-in user lacks Owner on the subscription.
Have a subscription Owner perform the role assignments, or request the Owner role.
2
App registration not found when adding a member
onelens-sa was created in a different tenant or hasn't propagated.
Confirm you are in the correct tenant and search by the exact name onelens-sa.
3
Client secret authentication fails
The secret Value was mistyped, expired, or you shared the ID instead of the Value.
Generate a new secret, copy the Value immediately, and re-share with OneLens.
4
No export files appear in the container
The export was scoped to the wrong subscription, or the first run hasn't completed.
Verify the export Scope and destination; wait up to 24 hours for the first run.
5
OneLens cannot read export files
Storage Blob Data Reader not assigned, or network default action is Deny.
Assign Storage Blob Data Reader and run az storage account update ... --default-action Allow.
6
Connected but no cost data after 24–48 hours
Missing Cost Management Reader role or resource providers not registered.
Confirm both Reader and Cost Management Reader are assigned and the four resource providers are registered.
7
AKS cost analysis command fails
Cluster is on the Free tier or required providers aren't registered.
Move the cluster to Standard/Premium and register Microsoft.ContainerService, Microsoft.Insights, Microsoft.OperationalInsights.
8
Costs not grouped by team/tag
Tag inheritance not enabled.
Enable tag inheritance.
Frequently Asked Questions
Can OneLens see our application data, VM contents, or database records?
No. OneLens reads cost/billing metadata, resource inventory metadata, and the Cost Management export files only. It has no access to the contents of your workloads.
Can OneLens modify or delete anything in our Azure environment?
No. Every role granted (Reader, Cost Management Reader, Billing reader/Billing account reader, Storage Blob Data Reader) is read-only. No write, modify, or delete permissions are assigned.
Why does OneLens need access via both an App Registration and an external user?
The App Registration (service principal) provides programmatic, automated access for ongoing data collection, while the invited external reader supports OneLens-side connection workflows. Both are read-only and scoped to the subscriptions you onboard.
Will this impact our Azure performance or bills?
No measurable performance impact. The only added cost is storing the daily export files (typically cents to a few dollars per month). OneLens runs no compute in your tenant.
Can I onboard multiple subscriptions?
Yes. For each additional subscription, follow Path B to extend Reader and Cost Management Reader access. A single export storage account can be reused.
How do I rotate the client secret?
In Entra ID → App registrations → onelens-sa → Certificates & secrets, create a new secret, copy its Value, share it with OneLens, then delete the old secret.
How do I disconnect OneLens?
Remove the role assignments for onelens-sa and the OneLens external user from each subscription and the storage account, delete the client secret (or the onelens-sa app registration entirely), and optionally delete the export and onelens-rg resource group. Notify OneLens so the connection is removed on their end.
Does enabling `--default-action Allow` make my storage account public?
No. It changes network-rule behavior only. Reading data still requires valid credentials and the Storage Blob Data Reader role.
Need Help?
OneLens Documentation:
Azure Documentation:
OneLens Support: support@astuto.ai
Reference sources: OneLens — Connecting to Azure at Subscription Level · OneLens — Connecting to Azure (overview) · OneLens — Automated using Terraform · Azure Cost Management exports · Azure RBAC role assignments
Last updated

