> For the complete documentation index, see [llms.txt](https://docs.onelens.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onelens.cloud/integrations/ai-integrations/azure-foundry.md).

# Azure Foundry

## TL;DR

* **What this does**: Gives OneLens read-only access to your Azure cost and usage data so it can deliver cost visibility, anomaly detection, and right-sizing recommendations across your subscriptions.
* **Time required**: \~30–45 minutes for a fresh setup; \~10 minutes if Azure is already connected and you're adding a subscription.
* **Who you need**: A user with the **Owner** role on each subscription being integrated (to create the App Registration, assign RBAC roles, and configure exports).
* **What OneLens reads**: Billing/cost-management metadata, resource inventory metadata (via the `Reader` role), and the Cost Management export files written to your storage account. Your application data, secrets, key contents, and workload payloads are never accessed.

## What You'll Get Once Connected

| Capability                         | What it does for you                                                                                                                     |
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Unified Cost Explorer**          | Single view of actual and amortized spend across all integrated subscriptions.                                                           |
| **Resource Right-Sizing**          | Flags over-provisioned VMs, disks, and other resources based on cost and usage metadata.                                                 |
| **Cost Allocation by Tag**         | Groups spend by business unit, environment, or team using billing, resource group, and subscription tags (with tag inheritance enabled). |
| **Anomaly Detection**              | Surfaces unexpected cost spikes against historical baselines.                                                                            |
| **Budget Tracking**                | Tracks spend against budgets and alerts when thresholds are approached.                                                                  |
| **Idle Resource Detection**        | Identifies unused or underutilized resources that can be stopped or deleted.                                                             |
| **AKS / Kubernetes Cost Insights** | Breaks down container costs per cluster, namespace, and workload when AKS cost analysis is enabled.                                      |
| **Storage Cost Insights**          | Highlights redundant, over-replicated, or low-access-tier storage spend.                                                                 |

## Security at a Glance

| Question                                              | Answer                                                                                                                                                                                                                               |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Does OneLens read our production or application data? | **No.** OneLens reads cost/billing metadata, resource inventory metadata, and the exported Cost Management files only. It has no access to the contents of your VMs, databases, or application workloads.                            |
| Is access read-only?                                  | **Yes.** The App Registration and external reader are granted only `Reader`, `Cost Management Reader`, `Billing reader`/`Billing account reader`, and `Storage Blob Data Reader`. No write, delete, or management roles are granted. |
| What authentication is used?                          | An Azure **App Registration (Service Principal)** with a client secret, plus an invited **external reader** identity. Credentials are scoped to the integrated subscriptions only.                                                   |
| How is data transmitted and stored?                   | All Azure API and blob access is over TLS. Cost exports are stored encrypted at rest in your own storage account (LRS). OneLens stores your client secret encrypted.                                                                 |
| Can I restrict access?                                | **Yes.** Roles are scoped per subscription and to the single storage account/container used for exports. You control which subscriptions and resource groups are onboarded.                                                          |
| Does enabling network access bypass RBAC?             | **No.** Setting the storage account network `--default-action Allow` controls network-level access only. Entities still require valid credentials and role assignments to read data.                                                 |

***

## Cost of the Integration

OneLens does not deploy any compute or paid services into your environment. The only Azure resources created are a **storage account** and a **resource group** (`onelens-rg`) to hold Cost Management export files. Costs are limited to storing and writing those export files.

| Item                        | What it is                                                                                                                   | Typical cost                             |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- |
| **Compute**                 | None — OneLens runs no compute in your tenant.                                                                               | $0                                       |
| **Cost Management exports** | Scheduled daily export of actual + amortized cost data. Exports themselves are free; you pay only for the resulting storage. | $0 (export feature)                      |
| **Blob storage**            | Parquet export files in a Standard LRS account. Volume depends on subscription size; typically a few GB.                     | \~$0.02–$0.50/month                      |
| **Data egress**             | OneLens reads exports and API metadata. Egress for metadata reads is negligible.                                             | <$0.05/month                             |
| **Estimated total**         | Sum of above                                                                                                                 | **\~$0.05–$0.55/month per subscription** |

> Costs scale with the number of resources and the volume of cost records. For very large subscriptions, storage may reach a few dollars per month. Standard LRS is the lowest-cost redundancy option and is recommended.

## How It Works

OneLens connects to Azure using an **App Registration (Service Principal)** that you create in Microsoft Entra ID. You assign read-only billing and resource roles to this service principal (and to a OneLens-provided external reader identity) scoped to the subscriptions you want to onboard.

OneLens collects data from two sources:

1. **Azure Cost Management exports** — You configure a daily export of actual and amortized cost/usage data (in Parquet format) to a storage account in your tenant. OneLens reads these files via the `Storage Blob Data Reader` role.
2. **Azure Resource Manager + Cost Management APIs** — Using the `Reader` and `Cost Management Reader` roles, OneLens reads resource inventory metadata and cost data to power right-sizing, anomaly detection, and allocation.

Optionally, enabling **AKS cost analysis** and **tag inheritance** enriches the data with per-cluster container costs and inherited tags for accurate cost allocation.

## Azure Integration

### Prerequisites

* The user performing the integration must have the **Owner** role on each subscription being integrated.
* The following resource providers must be enabled on the subscriptions in the management groups being onboarded:
  * `Microsoft.CostManagementExports`
  * `Microsoft.CostManagement`
  * `Microsoft.Billing`
  * `Microsoft.Storage`
* Know your Azure billing account type. Three types are supported, and only the IAM billing-permission step differs between them:
  * Microsoft Online Services Program / Pay-as-you-go (**MOSP / PayGo**)
  * Microsoft Customer Agreement (**MCA**)
  * Microsoft Enterprise Agreement (**EA**)
* Azure CLI installed (required for the storage network update and optional AKS steps).

### What OneLens will access

* **Cost Management & Billing data** — via `Billing reader` / `Billing account reader` and `Cost Management Reader`, to read spend by resource, service, and tag.
* **Resource inventory metadata** — via the subscription `Reader` role, to power right-sizing and idle-resource detection.
* **Cost export files** — via `Storage Blob Data Reader` on the single storage account holding the exports.

### What OneLens will NOT access

* ❌ The contents of your VMs, databases, storage objects (other than the export container), or application workloads.
* ❌ Any write, modify, or delete capability — all roles granted are read-only.
* ❌ Secrets, keys, or certificate material stored in your tenant.
* ❌ Subscriptions, resource groups, or storage accounts you do not explicitly onboard.

{% hint style="info" %}
Already have Azure connected to OneLens? If you've already onboarded another subscription, a management group, or a billing account, the App Registration (`onelens-sa`), client secret, storage account, cost exports, and OneLens external user already exist. You do **not** need to recreate them — skip to [Path B: Existing Azure Integration](#path-b-existing-azure-integration) and just extend access to the new subscription(s).
{% endhint %}

{% hint style="info" %}
Prefer an automated setup? OneLens also supports a seamless [automated integration using Terraform](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/automated-using-terraform), which provisions the App Registration, storage account, exports, and IAM roles for you.
{% endhint %}

## Path A: Fresh Setup (No Existing Azure Integration)

If this is your first OneLens Azure connection, follow the full step-by-step guide:

**➡️** [**OneLens — Connecting to Azure at Subscription Level**](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/at-subscription-level)

That guide walks through:

1. Creating the **App Registration** (`onelens-sa`) and copying the Client ID and Tenant ID.
2. Generating a **client secret** and copying its Value and ID.
3. Assigning **billing permissions** to the App Registration (`Billing account reader` for MCA/MOSP/PayGo, or `Billing reader` for EA).
4. Creating a **storage account** (`onelens-rg` resource group) and **container** (`onelens-cost-usage-reports`), and enabling **Cost Management exports** (actual + amortized, Parquet).
5. Assigning **Azure RBAC roles** to the App Registration (`Reader`, `Cost Management Reader` per subscription; `Storage Blob Data Reader` on the storage account).
6. Assigning **Azure RBAC roles** to the OneLens **external user** (`onelens.finops+<customername>@astuto.ai`).
7. Updating the **storage account network default action** (`az storage account update ... --default-action Allow`).
8. *(Optional)* Enabling **AKS cost analysis**.
9. *(Optional)* Enabling **tag inheritance**.

When you've finished those steps, continue to [Connect to OneLens](#connect-to-onelens) below to hand off the connection values.

## Path B: Existing Azure Integration

If your Azure environment is already connected to OneLens (at another subscription, a management group, or a billing account), the App Registration (`onelens-sa`), client secret, storage account, cost exports, and OneLens external user are already in place. You only need to extend read-only access to the new subscription. Do **not** recreate identities or storage.

{% stepper %}
{% step %}

## Confirm the required resource providers are registered on the new subscription.

```bash
for ns in Microsoft.CostManagementExports Microsoft.CostManagement Microsoft.Billing Microsoft.Storage; do
  az provider register --namespace $ns --subscription <newSubscriptionId>
done
```

{% endstep %}

{% step %}

## Assign `Reader` and `Cost Management Reader` on the new subscription

Assign `Reader` and `Cost Management Reader` on the new subscription to both the App Registration (`onelens-sa`) and the OneLens external user (`onelens.finops+<customername>@astuto.ai`).

For each identity: open **Subscriptions** → select the new subscription → **Access Control (IAM)** → **+ Add** → **Add role assignment** → assign `Reader`, then repeat for `Cost Management Reader`. The existing `Storage Blob Data Reader` grants on the shared storage account still apply, so no storage-account change is needed.
{% endstep %}

{% step %}

## Add the new subscription to a cost export.

If the existing export does not cover the new subscription, create a new export scoped to it (Cost Management + Billing → Exports), pointing at the **same** storage account and container (`onelens-cost-usage-reports`).
{% endstep %}

{% step %}

## Enable AKS cost analysis and tag inheritance

(Optional) Enable AKS cost analysis and tag inheritance for the new subscription.
{% endstep %}

{% step %}

## Continue to Connect to OneLens

Share only the new Subscription ID — the App Registration, secret, storage account, and container are unchanged.
{% endstep %}
{% endstepper %}

## Connect to OneLens

Once your chosen path is complete, share the following values with the OneLens team (via email to <support@astuto.ai> or through the OneLens dashboard) to finish the connection:

| Field                                                                  | Where to find it                                                           |
| ---------------------------------------------------------------------- | -------------------------------------------------------------------------- |
| **App Registration Tenant (Directory) ID**                             | Entra ID → App registrations → `onelens-sa` overview                       |
| **App Registration Client (Application) ID**                           | Entra ID → App registrations → `onelens-sa` overview                       |
| **App Registration Client Secret Value**                               | Entra ID → App registrations → `onelens-sa` → Certificates & secrets       |
| **App Registration Client Secret ID**                                  | Entra ID → App registrations → `onelens-sa` → Certificates & secrets       |
| **Storage Account name**                                               | The storage account holding the exports (`onelens-<customername>-billing`) |
| **Container name**                                                     | `onelens-cost-usage-reports`                                               |
| **Subscription ID(s) / Resource Group ID(s) / Management Group ID(s)** | The scopes you onboarded                                                   |

> **Existing integration?** If Azure is already connected, you only need to share the new **Subscription ID** — all other values are unchanged.

**Verification**: After OneLens confirms the connection (typically within 24–48 hours, once the first export has run), check the OneLens dashboard for:

* Cost data appearing in the Cost Explorer for each onboarded subscription.
* Resource inventory populated for right-sizing recommendations.
* AKS cost breakdowns (if AKS cost analysis was enabled).

## Data Refresh Schedule

* **Cost & usage data**: Azure Cost Management exports run daily; OneLens ingests the latest export files once per day. Daily cadence matches Azure's own export frequency and keeps storage cost minimal — polling more often does not surface fresher data.
* **Resource metadata**: Refreshed daily via the Azure Resource Manager APIs.

Current-period (month-to-date) figures may shift until the billing period closes and amortized costs are finalized.

## Data Privacy & Security

* ✅ **Read-only access** — only `Reader`, `Cost Management Reader`, `Billing reader`/`Billing account reader`, and `Storage Blob Data Reader` roles are granted.
* ✅ **Restricted scope** — access is limited to the subscriptions you onboard and the single export storage account/container.
* ✅ **No application data** — OneLens reads cost and resource metadata and export files only; it never reads VM, database, or workload contents.
* ✅ **TLS in transit, encrypted at rest** — all API/blob access is over TLS; exports are stored encrypted in your own storage account.
* ✅ **No write capability** — no role grants write, modify, or delete permissions.
* ✅ **Credentials stored encrypted** — your client secret is stored encrypted by OneLens and can be rotated at any time.
* ✅ **Network access does not bypass RBAC** — `--default-action Allow` affects network rules only; valid credentials and role assignments are still required.

## Troubleshooting

| # | Symptom                                         | Cause                                                                                    | Fix                                                                                                                                            |
| - | ----------------------------------------------- | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 | "Authorization failed" when assigning roles     | The signed-in user lacks **Owner** on the subscription.                                  | Have a subscription Owner perform the role assignments, or request the Owner role.                                                             |
| 2 | App registration not found when adding a member | `onelens-sa` was created in a different tenant or hasn't propagated.                     | Confirm you are in the correct tenant and search by the exact name `onelens-sa`.                                                               |
| 3 | Client secret authentication fails              | The secret `Value` was mistyped, expired, or you shared the `ID` instead of the `Value`. | Generate a new secret, copy the `Value` immediately, and re-share with OneLens.                                                                |
| 4 | No export files appear in the container         | The export was scoped to the wrong subscription, or the first run hasn't completed.      | Verify the export Scope and destination; wait up to 24 hours for the first run.                                                                |
| 5 | OneLens cannot read export files                | `Storage Blob Data Reader` not assigned, or network default action is `Deny`.            | Assign `Storage Blob Data Reader` and run `az storage account update ... --default-action Allow`.                                              |
| 6 | Connected but no cost data after 24–48 hours    | Missing `Cost Management Reader` role or resource providers not registered.              | Confirm both `Reader` and `Cost Management Reader` are assigned and the four resource providers are registered.                                |
| 7 | AKS cost analysis command fails                 | Cluster is on the **Free** tier or required providers aren't registered.                 | Move the cluster to **Standard**/**Premium** and register `Microsoft.ContainerService`, `Microsoft.Insights`, `Microsoft.OperationalInsights`. |
| 8 | Costs not grouped by team/tag                   | Tag inheritance not enabled.                                                             | Enable tag inheritance.                                                                                                                        |

## Frequently Asked Questions

<details>

<summary>Can OneLens see our application data, VM contents, or database records?</summary>

No. OneLens reads cost/billing metadata, resource inventory metadata, and the Cost Management export files only. It has no access to the contents of your workloads.

</details>

<details>

<summary>Can OneLens modify or delete anything in our Azure environment?</summary>

No. Every role granted (`Reader`, `Cost Management Reader`, `Billing reader`/`Billing account reader`, `Storage Blob Data Reader`) is read-only. No write, modify, or delete permissions are assigned.

</details>

<details>

<summary>Why does OneLens need access via both an App Registration and an external user?</summary>

The App Registration (service principal) provides programmatic, automated access for ongoing data collection, while the invited external reader supports OneLens-side connection workflows. Both are read-only and scoped to the subscriptions you onboard.

</details>

<details>

<summary>Will this impact our Azure performance or bills?</summary>

No measurable performance impact. The only added cost is storing the daily export files (typically cents to a few dollars per month). OneLens runs no compute in your tenant.

</details>

<details>

<summary>Can I onboard multiple subscriptions?</summary>

Yes. For each additional subscription, follow [Path B](#path-b-existing-azure-integration) to extend `Reader` and `Cost Management Reader` access. A single export storage account can be reused.

</details>

<details>

<summary>How do I rotate the client secret?</summary>

In Entra ID → App registrations → `onelens-sa` → Certificates & secrets, create a new secret, copy its `Value`, share it with OneLens, then delete the old secret.

</details>

<details>

<summary>How do I disconnect OneLens?</summary>

Remove the role assignments for `onelens-sa` and the OneLens external user from each subscription and the storage account, delete the client secret (or the `onelens-sa` app registration entirely), and optionally delete the export and `onelens-rg` resource group. Notify OneLens so the connection is removed on their end.

</details>

<details>

<summary>Does enabling `--default-action Allow` make my storage account public?</summary>

No. It changes network-rule behavior only. Reading data still requires valid credentials and the `Storage Blob Data Reader` role.

</details>

## Need Help?

**OneLens Documentation:**

* [Connecting to Azure (overview)](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure)
* [Connect at Subscription Level (full step-by-step)](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/at-subscription-level)
* [Automated integration using Terraform](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/automated-using-terraform)
* [Connect at Management Group](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/at-management-group)

**Azure Documentation:**

* [Create a Microsoft Entra application and service principal](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal)
* [Create exports with Cost Management](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-improved-exports)
* [Assign Azure roles using the portal](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal)
* [Enable tag inheritance](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/enable-tag-inheritance)

**OneLens Support**: <support@astuto.ai>

***

*Reference sources:* [*OneLens — Connecting to Azure at Subscription Level*](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/at-subscription-level) *·* [*OneLens — Connecting to Azure (overview)*](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure) *·* [*OneLens — Automated using Terraform*](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-azure/automated-using-terraform) *·* [*Azure Cost Management exports*](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-improved-exports) *·* [*Azure RBAC role assignments*](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.onelens.cloud/integrations/ai-integrations/azure-foundry.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.