Skip to main content
CostOptix reads cost data from the Azure Cost Management API. You will need an Azure Service Principal with Cost Management Reader and Reader roles on the target subscription.

​
Prerequisites

  • Azure CLI installed, or access to the Azure Portal
  • Permission to create Service Principals in your Entra ID (Azure Active Directory) tenant
  • The Subscription ID you want to monitor

​
Required Permissions

Both roles are required. Cost Management Reader alone is not sufficient for tag enumeration.

​
Step 1: Log in and select your subscription

​
Step 2: Create the Service Principal

This command creates the app registration, generates a secret, and assigns the Reader role in one step. The secret (password) is only shown once. Save it immediately.
The output contains:

​
Step 3: Add Cost Management Reader

​
Step 4: Enter credentials in CostOptix

Navigate to Organization Admin → Accounts → Add Account, select Microsoft Azure, and enter:
  • Tenant ID: from the tenant field above
  • Client ID: from the appId field above
  • Client Secret: from the password field above
  • Subscription ID: your Azure subscription ID

​
Setup: Managed Identity

If CostOptix is running on an Azure resource (VM, Container App, or AKS pod) with a Managed Identity assigned, you can use identity-based authentication without storing any secrets.
  1. Assign the Cost Management Reader and Reader roles to the Managed Identity on the target subscription (same commands as Step 2–3 above, replacing the Service Principal --assignee with the Managed Identity’s principal ID).
  2. In CostOptix, select Managed Identity as the authentication method. No additional credentials are required.

​
Billing Lag

Azure cost data has a lag of up to 5 days. Today’s spend will not appear immediately. This is an Azure platform constraint, not a CostOptix limitation.

​
Tag Explorer

The Azure Tag Explorer uses the Usage Details API to fetch per-resource tag data. This requires the Reader role in addition to Cost Management Reader. Tag keys are loaded on page entry; tag value cost breakdowns are fetched on demand.
The Tag Explorer fetches from the Usage Details API in real time. Large subscriptions with many resources may take a few seconds to load a tag key’s cost breakdown.

​
What else these roles power

The same two roles are enough for the Azure-only parts of Recommendations:
  • Orphaned resources. CostOptix uses Azure Resource Graph (covered by Reader) to find resources attached to nothing that still bill, such as unattached disks, unassociated public IPs, empty load balancers and stale snapshots.
  • Commitments. Savings plan and reservation recommendations use Azure’s own purchase recommendations where available.
No extra permissions are needed.

​
Troubleshooting

“AuthorizationFailed” or “Forbidden” Verify both Reader and Cost Management Reader are assigned at the subscription scope, not at a resource group scope. “InvalidSubscription” or subscription not found Confirm the Subscription ID is correct and that the Service Principal’s tenant matches the subscription’s tenant. Cost data shows zeros or is missing recent days Azure billing data can lag up to 5 days. Check the Azure portal’s Cost Analysis blade to confirm data is available there before investigating further. Client secret expired Service Principal secrets have an expiry. Create a new secret in Entra ID → App registrations → [your app] → Certificates & secrets and update the credential in CostOptix.