Create Azure App Registration

All Azure connections to Cloud View - Data#3 require an App Registration in Microsoft Entra ID (formerly Azure Active Directory / Azure AD). This app registration allows Cloud View - Data#3 to access cost, usage, reservation, and savings plan data through Microsoft APIs.

Step 1: Create the app registration

Sign in to the Azure Portal
Navigate to Microsoft Entra ID → App registrations → New registration
Enter a name such as Cloud View - Data#3 Connector
Supported account types: Accounts in this organizational directory only
Redirect URI: leave blank
Click Register

Step 2: Record the credential values

After registration:

Copy the Application (client) ID
Copy the Directory (tenant) ID
Under Certificates & secrets, create a New client secret and record its Value

⚠️ Keep the client secret safe — you will need the Tenant ID, Application (Client) ID, and Client Secret to connect Azure in Cloud View - Data#3.

Step 3: Assign subscription permissions

To allow Cloud View - Data#3 to access subscription data, you can either assign the built-in Reader role or create a custom role with only the specific permissions required.

Option A: Built-in Reader Role (Simplest)

In the Azure Portal, navigate to Subscriptions
Select a subscription you want Cloud View - Data#3 to access
Click Access control (IAM) in the left menu
Click Add → Add role assignment
Choose the role: Reader
Select Members: your App Registration (from earlier)
Click Review + assign

⚠️ Repeat this for all subscriptions you want Cloud View - Data#3 to monitor.
Alternatively, you can assign the Reader role at the Management Group level to grant access to all subscriptions within that group.

Option B: Custom Role (Least Privilege)

If your organisation requires least-privilege access, create a custom role with only the permissions Cloud View - Data#3 needs:

{
  "Name": "Cloud View - Data#3 Reader",
  "IsCustom": true,
  "Description": "Grants Cloud View - Data#3 read access to billing, consumption, insights, and resource data.",
  "Actions": [
    "Microsoft.Billing/*/read",
    "Microsoft.Commerce/*/read",
    "Microsoft.Consumption/*/read",
    "Microsoft.Insights/*/read",
    "Microsoft.ResourceGraph/*/read",
    "Microsoft.Advisor/*/read",
    "Microsoft.PolicyInsights/*/read",
    "Microsoft.Web/kubeEnvironments/read",
    "Microsoft.Kubernetes/connectedClusters/read",
    "Microsoft.Kubernetes/RegisteredSubscriptions/read",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Resources/tags/read"
  ],
  "NotActions": [],
  "AssignableScopes": ["/"]
}

To create and assign the custom role:

Navigate to any Subscription → Access control (IAM)
Click Add → Add custom role
Enter the role name (e.g. Cloud View - Data#3 Reader) and paste the permissions above
Set Assignable scopes to the subscriptions or management group
Click Review + create
Then assign this custom role to your App Registration on each subscription (or management group)

💡 Using the custom role means Cloud View - Data#3 has no access beyond what's listed above — this covers cost data, recommendations, resource metadata, and Kubernetes insights.

Step 4: Assign role for savings plans

To allow Cloud View - Data#3 to read Savings Plan data:

In the Azure Portal, navigate to the Savings Plans page.
Click Role Assignments at the top of the page.
Click Add → Add role assignment.
Choose the role: Savings Plan Reader
Select Members: your App Registration (from earlier)
Click Save

⚠️ You must repeat this once per tenant.
There is currently no management group–level equivalent for this permission.

Step 5: Assign role for reservations

To allow Cloud View - Data#3 to read Reservation data:

Navigate to the Reservations page.
Click Role Assignments.
Click Add → Add role assignment.
Choose the role: Reservations Reader
Select Members: your App Registration (from earlier)
Click Save

⚠️ As with Savings Plans, this role must be added per tenant, not at the management group level.

Step 6: Grant access to storage account

Cloud View - Data#3 needs access to read the export files from your storage account.

💡 Don't have a storage account yet? Go back to Create a Dedicated Storage Account first.

Navigate to the Storage Account you created for cost exports
Click Access control (IAM) in the left menu
Click Add → Add role assignment
Choose the role: Storage Blob Data Reader
Select Members: your App Registration (from earlier)
Click Review + assign

💡 For CSP imports, follow CSP Export Setup: prefer billing-scope CME, otherwise use subscription-scope CME or CDR.

Step 7 (Optional): Extend Access for Governance & Compliance Insights

🔐 Optional — This step is only required if your organisation wants to use Cloud View - Data#3's governance and compliance features, such as security posture assessments. You can skip this and complete it later.

To provide deeper insights into your security posture, Cloud View - Data#3 can read additional signals from Microsoft Entra ID and Azure Policy. This requires granting Microsoft Graph API permissions to your App Registration.

Grant Microsoft Graph Permissions

Go to your App Registration in the Azure Portal
Select API permissions in the left sidebar
Click + Add a permission → Microsoft Graph → Application permissions
Add each of the following permissions:

Permission	Purpose
`Policy.Read.All`	Read Conditional Access policies
`UserAuthenticationMethod.Read.All`	Read MFA registration status
`AuditLog.Read.All`	Read MFA user registration details
`RoleManagement.Read.Directory`	Read admin role assignments and PIM schedules
`Directory.Read.All`	Read directory objects and group memberships

After adding all four, click Grant admin consent for [Your Organisation] at the top of the API permissions page
Click Yes to confirm

⚠️ Admin consent is required. You need the Application Administrator or Cloud Application Administrator Entra ID role to grant consent. If you don't have this role, ask your Entra ID administrator.

✅ All four permissions should show a green "Granted" status once admin consent is applied.