Sustainability for Azure

Overview

Azure publishes your estimated carbon emissions through carbon optimization. To show them in OneLens, assign one built-in role, Carbon Optimization Reader, to the OneLens application on each subscription you want reported.

The role grants one thing and nothing else: reading carbon emission reports. It does not allow changes to any resource, and it does not expose service metrics or configuration.

Assign at subscription scope

Emissions permissions in Azure are honoured at subscription level only. A role assigned at a management group, resource group or individual resource does not grant access to emissions data, so the assignment has to be repeated for each subscription you want included.

Step 1: Assign Carbon Optimization Reader

You need Owner or Contributor on the subscription to make this assignment.

1

Open the subscription

Sign in to the Azure portal, go to Subscriptions, and select the subscription you want to report on.

2

Open Access control

In the left menu, select Access control (IAM).

3

Add the role assignment

Select + Add > Add role assignment. In the Role list, search for Carbon Optimization Reader and select it.

4

Select the OneLens application

On the Members tab, choose User, group, or service principal, select Select members, and search for the OneLens app registration you created during onboarding. It is named onelens-sa unless you chose a different name.

5

Review and assign

Select Review + assign to complete the assignment, then repeat for every other subscription you want included.

If you prefer the CLI, the same assignment is:

az role assignment create \
  --assignee <onelens-app-id> \
  --role "Carbon Optimization Reader" \
  --scope /subscriptions/<subscription-id>

Step 2: Allow for first-time registration

If nobody in your tenant has opened carbon optimization before, Microsoft registers your tenant on first use. This takes 30 minutes to an hour, during which the page can appear blank or show a registration message. Once registration completes it applies to everyone in the tenant and does not recur.

Step 3: Confirm the assignment

From the Azure CLI:

az role assignment list \
  --assignee <onelens-app-id> \
  --scope /subscriptions/<subscription-id> \
  --include-inherited \
  --output table

Carbon Optimization Reader should appear in the list for each subscription you configured.

What to send back to OneLens

No new credentials or IDs are needed. OneLens already has your tenant, application and subscription details from the original integration.

Tell us only which subscriptions you assigned the role on, if it is not all of the ones you onboarded. Azure reports access per subscription, so any subscription without the role is reported back to us as denied, and we would otherwise have to ask whether that was deliberate.

What you get in OneLens

	Detail
Granularity	Monthly
History	The last 12 months
Scopes	Scope 1, scope 2 and scope 3
Breakdown by	Subscription, resource group, resource, resource type, location
Published	By the 19th of the following month

Azure is the only one of the three major clouds that attributes emissions down to an individual resource, so an Azure estate supports a highest-emitting-resources view that AWS and Google Cloud cannot.

Good to know

• Azure keeps a rolling 12-month window. Carbon optimization does not serve data older than the last twelve months, so a multi-year baseline cannot be built from this source. OneLens retains what it has collected, so history accumulates from the point you connect onwards.

• Scope 2 figures may appear as zero. Carbon optimization shows scope 2 on a market-based basis. Where a region's energy is fully covered by Microsoft's renewable purchases, the market-based figure is legitimately zero, and is not a reporting failure.

• Subscriptions with no usage return nothing, as do subscriptions created less than a month ago, since at least one published month of usage is required.

• Carbon Optimization Reader covers emissions, not recommendations. Emission reduction recommendations are surfaced through the subscription Reader role that OneLens already holds from cost onboarding, so both are available once this role is added.