Connect Azure

Admin consent for the CostGlass application, Reader and Cost Management Reader roles, management group or subscription scope, and a Terraform version.

Connect Azure

Approve the CostGlass application once in your Microsoft Entra directory, then give it two read-only roles on the subscriptions you want covered.

Where in CostGlassSettings → Cloud Accounts → Azure
PlanAll plans
Who can do thisAn Entra administrator for the consent; an Owner or User Access Administrator for the roles
Time neededAbout 10 minutes
In short
  • No secret is created or pasted. You approve CostGlass's own application ("admin consent"), then assign it roles.
  • The roles are Reader and Cost Management Reader. Both are read-only.
  • Assign them on a management group to cover every subscription underneath, or on one subscription.
  • Three equivalent ways to assign roles: the Portal, an ARM template, or a script. A Terraform version is on this page.
  • If your policy forbids third-party applications, use "bring your own service principal" (one subscription only).
Before you begin
  • A Microsoft Entra administrator (Global Administrator, Application Administrator or Cloud Application Administrator) for step 1. It is a one-time step.
  • Someone with Owner or User Access Administrator on the subscription or management group, for step 2. This can be a different person.
  • Your tenant allows users to sign in to third-party multi-tenant applications.

The recommended flow

Cloud Accounts → Azure. One button starts the consent.

The wizard has three steps: Connect Tenant, Grant Access, Verify & Finish.

1
Start
Go to Settings → Cloud Accounts, open the Azure tab and click Connect with Microsoft on Step 1: Connect Your Azure Tenant. If the button is disabled, one-click connect is not configured on this CostGlass deployment: contact support or use the advanced flow below.
2
Accept on the Microsoft page
Sign in as the Entra administrator and accept the permission request. This adds an enterprise application called CostGlass to your tenant. CostGlass never sees your password. The app asks for no Microsoft Graph permissions.
3
Return to CostGlass
You land back on Step 2: Grant Reader + Cost Management Reader. The tenant is recorded but has no access yet: that is deliberate, you choose the scope next. If consent fails, the page shows the Microsoft error message.
4
Assign the two roles
Use one of the three methods below. The optional checkbox "Also enable Instance Scheduler (optional — write access)" adds a VM start and stop role; leave it off for read-only.
5
Verify
Click I've granted access — Verify. CostGlass lists the subscriptions it can now see, looks for a management group, and marks the connection active. A success panel reports how many subscriptions were discovered.
Note
Azure can take a few minutes to apply a new role assignment. If Verify says no subscription grants Reader access yet, wait two minutes and try again.

Subscription or management group?

Management groupWhole tenant
Assign the roles on a management group (the root group covers everything). One grant covers every subscription underneath, including ones added later. Use the Portal method.
One subscription
Assign the roles on the subscription. Choose this if you only want specific subscriptions. Repeat per subscription, or use the ARM template or script for each.

After verify, CostGlass looks for a management group it can read. If it finds one it queries cost and resources at that scope in a single call; otherwise it loops over the subscriptions it can see.

The three ways to assign the roles

Manual (Portal), the default

1
Open the scope
In the Azure Portal open the Subscription, or a Management Group for tenant-wide cover.
2
Open IAM
Click Access control (IAM).
3
Add the first role
Click + Add → Add role assignment, select Reader, click Next.
4
Choose CostGlass
Under Members click + Select members, search for CostGlass, select it, then Review + assign (twice).
5
Add the second role
Repeat for Cost Management Reader.

ARM template (one subscription)

On the ARM Template tab click Download Template (costglass-role-assignment.json), then Open Custom Deployment. In the Portal choose Build your own template in the editor → Load file, pick the subscription, and for costglassPrincipalId paste the Object ID of the CostGlass enterprise application (Microsoft Entra ID → Enterprise applications → CostGlass → Object ID). The template cannot target a management group; use the Portal method for that.

Script (Azure CLI)

On the Script tab copy the one-line command, which looks like curl -sSL ".../v1/azure/scripts/assign-roles.sh" | bash -s -- --app-id <CostGlass app ID>. You must be signed in with az login in the consented tenant. It uses your current subscription; add --subscription <id> or --management-group <id> to choose. You can download the script first and read it.

RoleAccessUsed for
ReaderRead-onlyListing subscriptions and resources (inventory).
Cost Management ReaderRead-onlyReading cost data.
CostGlass VM Scheduler (optional)WriteStart and deallocate virtual machines, read and write scale set capacity. Nothing else. Created only if you tick the Instance Scheduler checkbox.
Billing profile reader (billing profile scope)Read-onlyCredits, reservations, savings plans, their utilisation and purchase recommendations. This is the one billing role CostGlass asks for, and commitment tracking needs nothing beyond it.

Terraform equivalent for the role assignments

Consent in step 1 cannot be done with Terraform: it is the one click that needs a directory administrator. After it, the CostGlass enterprise application exists in your tenant and you can manage its roles as code. Find its Object ID under Microsoft Entra ID → Enterprise applications → CostGlass, or with az ad sp show --id <CostGlass app ID> --query id -o tsv (the app ID is in the Script tab command).

main.tf (azurerm ~> 4.0)

Set scope to /subscriptions/<id> or /providers/Microsoft.Management/managementGroups/<id>. After terraform apply return to CostGlass and click I've granted access — Verify.

Hand-maintained
This mirrors the roles the Portal, ARM template and script grant. The ARM template and script in the wizard are the reference; compare if CostGlass changes them.

Advanced: bring your own service principal

Choose this if your organisation will not allow third-party applications. You create the application yourself and give CostGlass its credentials. It covers one subscription only.

1
Open the advanced flow
On the Azure tab click Advanced: bring your own service principal instead.
2
Create the principal
Step 1: Create a Read-Only Service Principal: download setup-costglass-sp.sh (or use the one-line command) and run it with the Azure CLI. It needs Owner or User Access Administrator on the subscription. It creates an app registration named CostGlassReadOnly with Reader and Cost Management Reader and prints the credentials. Click Next: Enter Credentials →.
3
Paste the values
Fill Tenant ID, Client (App) ID, Client Secret, Subscription ID and optionally Account Display Label, then click Connect Azure Subscription. CostGlass tests the credentials first. The secret is stored encrypted in a secrets vault.
Tip
Secrets created by the Azure CLI expire. Note the expiry date; when it passes, cost sync stops until you create a new secret and reconnect.

Optional: show your Azure credits

Azure applies credits (for example the Azure sign-up credit) when it produces your invoice, at the billing profile, not on the subscription. That is why Azure's own cost screens show the full usage and CostGlass, which reads the same cost data, showed it too, even when your credit covered all of it and your invoice was £0.

The connect wizard shows these steps as soon as you finish connecting, and the Azure card keeps showing them until it works. With one extra read-only permission, CostGlass also reads your credits from Azure's billing records. Then Cost Explorer shows the cost net of credit (use the credits control to see the gross cost instead), and the Azure card on Settings → Cloud Accounts shows how much credit is left and when it expires. Unused credit is lost when it expires, so CostGlass also adds a note in Cost Explorer when a credit is within 30 days of expiring.

1
Open your billing profile
In the Azure portal open Cost Management + Billing, then Billing profiles and choose the profile that pays for your subscription.
2
Add the role
Open Access control (IAM), choose Add, pick the role Billing profile reader and select the CostGlass service principal (enterprise application). It can't change anything: it can only read.
3
Check it
Back on the Azure card choose Check again. CostGlass tests the access straight away and tells you if Azure still refuses it (a new role can take a few minutes to apply). Otherwise it is picked up on the next sync, which runs regularly (about every 6 hours).
What you will seeWhat it means
"Credits not shown" on the Azure cardThe role above has not been added yet (or has not taken effect). Costs are unaffected.
Credit applied to a past monthExact: the amount on that month's invoice.
Credit applied to the current monthAzure's own estimate of the credit it will apply to charges so far. It is updated by Azure every few days, so the last day or two of usage can show as cost until it catches up. It is replaced by the exact invoice amount once the invoice is issued.
Note
Credits are read for Microsoft Customer Agreement billing profiles (the usual account type for new Azure sign-ups and pay-as-you-go). For other agreement types (such as an Enterprise Agreement) credits are not shown. With several subscriptions on one billing profile, the credit is shared between them in proportion to their usage, because Azure applies it to the profile, not to a single subscription. Connections fed by the Azure cost export get credits from the export instead and need nothing extra.

After connecting

  • The Connected Azure Accounts card shows each connection with a Tenant-wide badge for consent-based ones, subscription count, resources and last sync.
  • Cost and inventory fill in on the next 6-hourly sync.
  • A connection stuck at pending shows Finish granting access →.
  • Use Connect another tenant for a second Entra tenant (counts toward your plan limit).
  • Disconnect from the same card or from Cloud Accounts.

Azure Instance Scheduler is the only Azure write access, and it is opt-in.

Why does CostGlass need an enterprise application in my tenant?
That is how Azure lets a third party be given roles without sharing a secret. The application is created by your admin consent and you can remove it at any time from Enterprise applications.
I cannot find CostGlass when adding the role.
The consent in step 1 has not completed in this tenant, or you are in a different tenant. Repeat step 1 as an Entra administrator.
Verify says "no subscription grants Reader access yet".
The roles are not assigned at a scope CostGlass can see, or have not propagated. Check both roles are assigned to CostGlass, wait a couple of minutes, and verify again.
Which is better, a subscription or a management group?
A management group, if you want everything and future subscriptions covered by a single grant.
How do I remove access?
Disconnect in CostGlass, then delete the role assignments and, if you want, the CostGlass enterprise application in Entra.

Related guides