Configure Azure tenants
3 minute read
Before connecting your Azure tenant to CloudBolt Platform, ensure that your billing account type is supported and that your Azure administrator has the required permissions for onboarding.
CloudBolt does not request any additional permissions. Any elevated permissions granted to your Azure administrator may be removed once onboarding completes.
To learn more about the resources CloudBolt creates during onboarding, refer to Connect Azure.
This process takes approximately 10–15 minutes. If you choose to include 12 months of historical cost data (recommended), the background data import runs for an additional 15–60 minutes.
Supported billing account types
| Type | Supported | Notes |
|---|---|---|
| Enterprise Agreement (EA) | Yes | Full support |
| Microsoft Customer Agreement (MCA) | Yes | Full support |
| Microsoft Partner Agreement (MPA) | Yes | Full support; optional Lighthouse delegation for cross-tenant access |
| Pay as you go (PAYG) | Limited | Cost exports supported; billing hierarchy and discovery may be limited |
Required Azure permissions
Microsoft Entra ID: Application Administrator or Global Administrator
The onboarding wizard registers an application and creates a service principal in your Microsoft Entra ID tenant, granting CloudBolt read access to your cost and inventory data. Ensure your administrator has appropriate permissions.
Where to check: Azure Portal > Microsoft Entra ID > Users > [user] > Assigned roles
The administrator must have one of the following roles assigned:
- Global Administrator
- Application Administrator
- Cloud Application Administrator
Subscription: Contributor (or higher) in at least one subscription
During onboarding, CloudBolt creates a resource group and storage account in one of your Azure subscriptions. The storage account is where Azure Cost Management writes your daily cost export files. Ensure your administrator has at least Contributor access on the target subscription.
Where to check: Azure Portal > Subscriptions > [subscription] > Access control (IAM) > Role assignments
Billing account: Billing Account Owner or Enterprise Administrator
CloudBolt grants its service principal read-only access to your billing account, then sets up daily Cost Management exports scoped to it. Ensure your administrator can assign roles on the billing account. Reader and contributor roles can’t assign roles, so onboarding fails with them.
Where to check: Azure Portal > Cost Management + Billing > Billing scopes > [billing account] > Access control
Roles per billing account type
| Billing account type | Role |
|---|---|
| Enterprise Agreement (EA) | Enterprise Administrator (not read-only) |
| Microsoft Customer Agreement (MCA) | Billing Account Owner (a Global Administrator can elevate to this role) |
| Microsoft Partner Agreement (MPA) | Global Admin or Billing Admin (Partner Center) |
Management group: User Access Administrator (recommended)
CloudBolt assigns a read-only role in your root management group so it can automatically discover subscriptions, including any added in the future. To allow this, ensure your administrator has the User Access Administrator role on the root management group.
Where to check: Azure Portal > Management Groups > [root management group] > Access control (IAM)
If this permission is not available, CloudBolt assigns read access to each subscription. Subscriptions created after this must be onboarded separately.
In the Azure Portal, go to Microsoft Entra ID > Properties and enable Access management for Azure resources. This can be disabled after onboarding.
Next steps
Continue to Connect Azure to connect your Azure tenant.