Connecting an Azure account

Overview

To onboard your Azure environment to DigiUsher, an App Registration with read-only access to cost, usage, and resource metadata is required. This document describes exactly what permissions are requested, why each is needed, and what credentials to provide.

Supported Agreement Types

Summary of Access Required

DigiUsher cannot create, modify, or delete any of your Azure resources.

If your organization's policies require manual resource provisioning, follow the steps below.

Prerequisites

Information to Gather

Roles Required by the Person Performing Setup

Not sure whether you hold these billing roles, or at what level? Follow Check Your Permission Level below.

Check Your Permission Level

DigiUsher reads cost data from a FOCUS export created at your billing scope. For complete, organization-wide visibility, the export must be created at the top-level billing scope — the EA billing account (enrollment) or the MCA billing account. Azure also lets you create exports at lower scopes (an EA enrollment account, an MCA billing profile or invoice section, or a single subscription), and an export created there will silently contain only that scope's spend. Before starting, confirm what level of billing access you actually have.

1. Identify your agreement type

1. Go to Cost Management + Billing → Billing scopes
2. Check the Billing account type column:
   • Enterprise Agreement → follow the EA steps below
   • Microsoft Customer Agreement → follow the MCA steps below
   • Microsoft Online Services Program (pay-as-you-go) → not supported; FOCUS exports require EA or MCA

Or use the Azure CLI:

az billing account list --query "[].{Name:displayName, ID:name, Type:agreementType}" -o table

2. Check your role and its scope

Option A: Terraform (Recommended)

The DigiUsher Terraform configuration automates the entire setup.

git clone https://github.com/digiusher/digiusher-iac.git
cd digiusher-iac/azure

Copy the example file that matches your agreement type (see Supported Agreement Types above):

# Pick ONE of the following:
cp terraform.tfvars.scenario1-ea-billing-account terraform.tfvars      # EA — Billing Account
cp terraform.tfvars.ea-enrollment-account-example terraform.tfvars     # EA — Enrollment Account
cp terraform.tfvars.scenario3-mca terraform.tfvars                     # MCA — Billing Account
cp terraform.tfvars.mca-invoice-section-example terraform.tfvars       # MCA — Invoice Section

# Edit terraform.tfvars with your values
terraform init
terraform plan
terraform apply

Terraform Feature Flags

See the digiusher-iac README for full Terraform documentation including all parameters and troubleshooting.

Option B: Manual Setup

Follow these steps if you prefer to set up via the Azure Portal.

Connect in DigiUsher

After completing either the Terraform or Manual setup, enter the following into the DigiUsher platform to complete the connection:

Verification Checklist

• Confirmed top-level billing access (EA: Enterprise Administrator; MCA: Billing account owner) — or accepted scoped data at a lower level
• App registration created with client secret
• Reader role assigned at Management Group (or Subscription) level
• Storage account and container created
• Storage Blob Data Reader role assigned on storage account
• FOCUS export created and scheduled
• (Optional) Reservations Reader and Savings Plan Reader assigned
• Elevated access disabled (if used)
• *.digiusher.com allowlisted in network/firewall (if applicable)
• digiusher.com allowlisted for incoming email (if applicable)

Security

What DigiUsher CAN Access (Read-Only)

• Cost and usage data via FOCUS exports in Azure Storage
• Resource metadata (names, types, regions, tags) via Reader role
• Reservation and Savings Plan information (if optional access granted)
• Management Group, subscription, and resource group hierarchy

What DigiUsher CANNOT Do

• Create, modify, or delete any Azure resources
• Access application data, databases, or storage contents (beyond cost exports)
• Modify IAM policies or role assignments
• Read secrets, credentials, or encryption keys
• Access network traffic or logs content
• Make purchases or modify billing settings

Monitoring

Monitor App Registration activity in Microsoft Entra ID > Enterprise applications > DigiUsherApp > Sign-in logs and Audit logs.

Credential Rotation

• Terraform: terraform apply -replace="azuread_application_password.digiusher"
• Manual: App Registration > Certificates & secrets > New client secret (create new), then delete the old secret. Enter the new secret into the DigiUsher platform.

Revocation

• Terraform: terraform destroy — removes the App Registration, all role assignments, and invalidates the client secret.
• Manual: Delete the DigiUsherApp App Registration in Microsoft Entra ID > App registrations. This instantly invalidates the client secret and all associated role assignments.

Troubleshooting

Export not appearing

• Ensure Microsoft.CostManagementExports resource provider is registered
• Go to Subscription → Resource providers → Search for CostManagementExports → Register

Permission denied on billing scope

• EA: Verify you have Enterprise Administrator access at the billing account (enrollment) level — see Check Your Permission Level. Some EA accounts require the enrollment admin to grant access via the EA Portal first.
• MCA: Verify you have Billing account owner access on the billing account itself, not just a billing profile or invoice section — see Check Your Permission Level. MCA uses a separate billing RBAC system — standard ARM roles like Cost Management Contributor do not apply. The Terraform configuration handles this automatically.

Cannot see Management Groups

• Go to Management Groups → Start using management groups
• You may need to elevate access (Step 6a) to see the tenant root group

Need Help?

If you encounter any issues not covered above, contact DigiUsher support at support@digiusher.com and the team will help you get set up.