Connecting an Azure account

Overview

To connect your Azure environment to DigiUsher, you create an App Registration. It needs read-only access to your cost data, usage data, and resource metadata. This page gives the permissions, the reason for each permission, and the credentials that you enter in DigiUsher.

Supported Agreement Types

Summary of Access Required

DigiUsher cannot create, change, or delete an Azure resource. The only exception is the optional Terraform flag enable_power_scheduler, which is off by default. This flag creates a custom role that can start and deallocate virtual machines.

If the policies of your organization need a setup by hand, use the manual steps on this page.

Prerequisites

Information to Gather

Roles Required by the Person Performing Setup

If you do not know whether you have these billing roles, or at which level, read Check Your Permission Level.

Check Your Permission Level

DigiUsher reads the cost data from a FOCUS export at your billing scope. For the data of the whole organization, create the export at the top-level billing scope. This scope is the EA billing account, which Azure calls the enrollment, or the MCA billing account.

Azure also lets you create an export at a lower scope, such as an EA enrollment account, an MCA billing profile, an invoice section, or one subscription. An export at a lower scope contains the spend of that scope only, and Azure gives no warning. Before you start, make sure that you know the level of your billing access.

1. Identify your agreement type

1. Go to Cost Management + Billing → Billing scopes.
2. Read the column Billing account type:
   • Enterprise Agreement: use the EA steps on this page.
   • Microsoft Customer Agreement: use the MCA steps on this page.
   • Microsoft Online Services Program, which is pay-as-you-go: DigiUsher does not support it. A FOCUS export needs EA or MCA.

You can also use the Azure CLI:

az billing account list --query "[].{Name:displayName, ID:name, Type:agreementType}" -o table

2. Check your role and its scope

Option A: Terraform (Recommended)

The DigiUsher Terraform configuration does the full setup.

git clone https://github.com/digiusher/digiusher-iac.git
cd digiusher-iac/azure

Copy the example file of your agreement type. The section Supported Agreement Types gives the file names:

# Pick ONE of the following:
cp terraform.tfvars.scenario1-ea-billing-account terraform.tfvars     # EA — Billing Account
cp terraform.tfvars.scenario2-ea-enrollment-account terraform.tfvars  # EA — Enrollment Account
cp terraform.tfvars.scenario3-mca terraform.tfvars                    # MCA — Billing Account or Invoice Section

# Edit terraform.tfvars with your values.
# For an MCA invoice section, set billing_scope_level = "invoice_section"
# and fill in billing_profile_id and invoice_section_id.
terraform init
terraform plan
terraform apply

Terraform Feature Flags

The digiusher-iac README is the full Terraform documentation. It gives all parameters and the troubleshooting steps.

Option B: Manual Setup

Use these steps for a setup in the Azure Portal.

Connect in DigiUsher

After you complete the Terraform setup or the manual setup, go to Connectors > Add Source and select Microsoft Azure. On the Configure step, enter the values in the table, then click Review. On the Connect step, click Connect source.

If you use Terraform, one output gives all values:

terraform output -json digiusher_onboarding

Setup Checklist

• Top-level billing access confirmed (EA: Enterprise Administrator, MCA: Billing account owner), or you accept the data of a lower scope
• App registration created, with a client secret
• Reader role given at the level of the Management Group or the Subscription
• Storage account and container created
• Storage Blob Data Reader role given on the storage account
• FOCUS export created and scheduled
• Reservations Reader and Savings Plan Reader given (optional)
• Elevated access disabled again (if you used it)
• *.digiusher.com in the allowlist of the network and the firewall (if your organization restricts this)
• digiusher.com in the allowlist for incoming email (if your organization restricts this)

Security

What DigiUsher CAN Access (Read-Only)

• The cost data and the usage data in the FOCUS exports in Azure Storage
• The resource metadata, such as names, types, regions, and tags, through the Reader role
• The information about the Reservations and the Savings Plans, when you give that optional access
• The hierarchy of the Management Groups, the subscriptions, and the resource groups

What DigiUsher CANNOT Do

• Create, change, or delete an Azure resource
• Read application data, databases, or the content of your storage. It reads the cost exports only
• Change an IAM policy or a role assignment
• Read secrets, credentials, or encryption keys
• Read network traffic or the content of your logs
• Buy a product or change the billing configuration

Monitoring

To monitor the activity of the App Registration, open Microsoft Entra ID > Enterprise applications > DigiUsherApp > Sign-in logs and Audit logs.

Credential Rotation

• With Terraform, run terraform apply -replace="azuread_application_password.app_password". Then read the new secret with terraform output -json digiusher_onboarding, and enter it in the DigiUsher platform.
• By hand, open the App Registration and click Certificates & secrets > New client secret to create a new secret. Then delete the old secret, and enter the new secret in the DigiUsher platform.

Revocation

• With Terraform, run terraform destroy. It removes the App Registration and all role assignments, and it invalidates the client secret.
• By hand, delete the App Registration DigiUsherApp in Microsoft Entra ID > App registrations. Azure then immediately invalidates the client secret and all its role assignments.

Troubleshooting

Export not appearing

• Make sure that the resource provider Microsoft.CostManagementExports is registered.
• Go to Subscription → Resource providers, search for CostManagementExports, and click Register.

Permission denied on billing scope

• On EA, make sure that you have Enterprise Administrator access at the level of the billing account, which Azure calls the enrollment. Read Check Your Permission Level. In some EA accounts, the enrollment admin must give this access in the EA Portal first.
• On MCA, make sure that you have Billing account owner access on the billing account itself, and not on a billing profile or an invoice section. Read Check Your Permission Level. MCA uses its own billing RBAC system, and a standard ARM role such as Cost Management Contributor does not work there. The Terraform configuration does this correctly.

Cannot see Management Groups

• Go to Management Groups → Start using management groups.
• To see the root group of the tenant, you can need the elevated access from Step 6a.

Need Help?

If this page does not answer your question, write to DigiUsher support at support@digiusher.com. The team will help you.