Connecting Azure to CostReveal, setup guide

Azure spend reaches finance as one invoice per billing account, and the question that follows is always the same: which team, product or customer is behind each line. This guide covers how CostReveal reads Azure spend from a Cost Management export in FOCUS, what you need before you start, each setup step in order, how spend is explained with tags, how Azure OpenAI appears, and how every month is checked against Azure's own figures.

What the Azure connection reads

CostReveal reads a Cost Management export in FOCUS, the FinOps Foundation's open cost format, which Azure writes to a storage container in your own subscription. That export is the whole of what CostReveal reads: every line of billed cost for the billing period it names, with its service, meter, region, resource and tags.

Nothing is installed in your workloads, and no secret of yours is exchanged. CostReveal's own Microsoft Entra application is given read access to that one container, and can read nothing else. If you choose, it can also be allowed to read Cost Management's own monthly total, which CostReveal uses as a second check, and Azure Advisor's cost recommendations, which Insights lists under Savings.

What you need

Before you start, check four things:

• A billing account or billing profile under an Enterprise Agreement or a Microsoft Customer Agreement. FOCUS exports are offered at those scopes, and not for pay as you go subscriptions bought on their own.
• Permission to create Cost Management exports at that scope, and a storage account to write the export to.
• A Microsoft Entra administrator, who can consent to an application in your tenant.
• An owner or admin role in CostReveal.

Step by step setup

1. Create the FOCUS export

In the Azure portal, open Cost Management at the billing account or billing profile, and create an export of Cost and usage details (FOCUS). Set it to run daily for the month to date, in Parquet or CSV, with overwrite turned on, so each run replaces the last rather than piling up copies. The first run can take up to a day.

2. Start the connection and consent

In CostReveal, go to Connections and choose Connect Azure. CostReveal shows its application and a consent link for your tenant. An administrator opens the link and consents. Consent alone grants nothing: the application now exists in your tenant, with no access to anything.

3. Grant read access to the export's container

Grant the application Storage Blob Data Reader on the export's container. CostReveal shows the exact command, filled in as you type the storage account and container, so the grant is scoped to that one container.

4. Optionally, allow the monthly check

To have every month compared with Cost Management's own total, grant the application Cost Management Reader on a subscription, or a billing reader role on the billing account or billing profile, and enter that scope. This step is optional; without it, the connection still works, and the check is the one CostReveal always makes between the ledger and attribution.

The same role on a subscription also lets CostReveal read Azure Advisor's cost recommendations there, such as virtual machines to resize or shut down and reservations to buy, each with what Advisor estimates it saves a month at your rates. Grant it on each subscription whose recommendations you want under Insights, Savings. CostReveal reads them once a day and changes nothing.

5. Verify and connect

Enter the tenant ID, the storage account, the container, the directory and the export name, then choose Verify and connect. Only the format of each field is checked as you type. When you verify, CostReveal reads the export before saving anything, and points at the field to fix if it cannot.

How often it reads, and how much history

Cost Management runs the export once a day, and CostReveal reads it every four hours, so a new run is picked up soon after it lands. For the first five days of a month, Azure also rewrites the month before with its late charges. CostReveal records those as corrections.

CostReveal reads every month the export holds, however old: the months it has run for, from the one it was created in. After that, each run's months are read as they change.

Connection states

Under Connections, the Azure connection is always in one of four states:

• Setup not finished: the details have not been verified yet.
• Waiting for first data: everything was verified, and the export's first run has not landed yet.
• Connected: the export was read and the latest read succeeded.
• Needs attention: the latest read failed, for example because the application lost access to the container. Everything already read is kept.

How Azure spend is explained

Every figure in CostReveal carries its evidence, so you always know how sure it is.

• Direct: the service, which Azure reports itself. Each line also keeps its meter, region and resource.
• Inferred: the team, feature and customer, when a tag names them. Tags are read with the project's tag keys, the same way as for AWS or Google Cloud, so a key such as team or cost-center works however it is written.
• Allocated: a share of a cost an allocation rule divides, for example a shared networking subscription split between teams by fixed percentages, evenly, or in proportion to what each team's tags already explain.
• Unknown: spend no tag or rule explains yet. It is shown as unknown, with its amount, and never spread across teams to look complete.

Tag inheritance

Many organizations tag resource groups or subscriptions rather than every resource. Those tags reach costs only when tag inheritance is turned on in Cost Management, which copies resource group and subscription tags onto the resources' costs. Turn it on, and spend tagged at those levels becomes inferred with no extra tagging. Inheritance covers resource group and subscription tags only.

A subscription that belongs to one team

When a whole subscription belongs to one team, you do not need to tag it at all. Write an allocation rule on the account, the subscription, naming its team. That spend is then inferred from the rule, and the rule is shown with it, so anyone can see why.

Azure OpenAI

Azure OpenAI is on your Azure bill, so it arrives through this connection, shown by service and meter. Azure's export names models only inside its meter text, so Azure spend has no model in CostReveal, and usage data does not divide it among your customers today.

How figures are checked

Two checks run on every month.

The ledger against attribution. Every line is recorded exactly as the export states its billed cost, for the billing period it names. Credits, tax and purchases are kept as their own kinds of charge, and a correction to an earlier period is its own line. Each month's newest export run is read once; a run that changes a month restates exactly the lines it changed, and keeps what was said before. Attribution on every dimension must then add up exactly to that ledger.

The ledger against Cost Management, when Cost Management Reader is granted. Each month is compared with Cost Management's own total for the same usage. While the month is open, a difference is pending, because both sources are still filling in. Once the invoice is issued, a difference is flagged as a variance, never adjusted away. Without that role, CostReveal says only that every amount is attributed.

Getting more of Azure spend explained

The fastest gains are usually these:

1. Turn on tag inheritance, so resource group and subscription tags count.
2. Write an allocation rule for each subscription that belongs to one team, so it is explained without tagging.
3. Add a tag key you already use. If your resources carry owner or department rather than team, those are among the default keys; anything else can be added under the project's tag keys.
4. Split shared subscriptions with a rule, so shared platforms are allocated in the open rather than left unknown.

Explore then shows the result by team, service, account, region or any custom dimension you define, such as environment.

Troubleshooting

• Verify says the export cannot be read. Check the storage account, container and directory names, and that Storage Blob Data Reader was granted on that container to CostReveal's application.
• Waiting for first data for a day or more. The export's first run can take up to a day. Check in Cost Management that the export has run and wrote to the container you entered.
• Spend tagged on a resource group shows as unknown. Turn on tag inheritance in Cost Management; until then, those tags are not on the costs.
• No monthly check against Cost Management. Grant Cost Management Reader on a subscription, or a billing reader role, and enter that scope in the connection.
• No Azure Advisor recommendations under Savings. Grant Cost Management Reader on the subscriptions they are for; they are read on the connection's next daily read.

Removing the connection

Removing the connection under Connections deletes every figure it brought in from the project, and its archived reports are deleted within a day. Remove the application's access, or the application itself, in Azure too. To stop reading without removing anything, take away the application's access to the container: CostReveal keeps every figure already read and tells you new data has stopped.

Frequently asked questions

Does CostReveal work with a pay as you go Azure subscription? FOCUS exports are offered for billing accounts and billing profiles under an Enterprise Agreement or a Microsoft Customer Agreement, not for pay as you go subscriptions bought on their own, so those cannot be connected this way today.

What access does CostReveal's application have? Consent creates the application in your tenant with no access. It can read only what you grant: Storage Blob Data Reader on the export's container, and optionally Cost Management Reader for the monthly check.

How quickly does new spend appear? Cost Management runs the export once a day, and CostReveal reads it every four hours, so new spend appears within hours of each export run.

How much history is brought in? Every month the export holds, however old: the months it has run for, from the one it was created in.

Why does my Azure OpenAI spend have no model? Azure's export names models only inside meter text, so CostReveal shows Azure OpenAI by service and meter, and keeps each meter on the line.

Is my Azure data kept apart from other customers? Yes. It is stored in CostReveal's database, with each organization isolated by PostgreSQL row level security, below the application.

Keep reading

• Connecting AWS to CostReveal: the Cost and Usage Report, the read only role, and cost allocation tags.
• Connecting Google Cloud to CostReveal: the BigQuery billing export and project labels.
• Connect Azure in the docs: the reference for every setup step.