Troubleshooting Azure Connections

Use the checks below to resolve common issues when connecting Microsoft Azure to Cloud View - Data#3 or when data fails to appear after setup.

1. Connection Validation Fails

When adding an Azure connection in Cloud View - Data#3, the validation step confirms access to both Azure APIs and Cost Management Exports.
If this step fails:

Possible causes

  • Incorrect Tenant ID, Client ID, or Client Secret
  • Missing Reader role on one or more subscriptions
  • Client secret expired or revoked
  • Conditional Access or MFA blocking the service principal

How to fix

  1. Re-open your App Registration → Certificates & secrets and confirm that the secret is active and not expired.
  2. In each subscription (or at the management group level), confirm the App Registration has the Reader role.
  3. Check for Conditional Access policies that may block service principal sign-ins.
  4. Retry validation in Cloud View - Data#3.

2. No Cost Data Appearing

If the connection validates successfully but no cost data is visible after 24 hours:

Possible causes

  • Cost Management Export not yet created or scheduled
  • Export path or credentials mis-configured
  • Storage Account access denied for the App Registration
  • Export file not yet generated by Azure (usually within 24 hours)
  • Cloud View - Data#3 does not have access to read the export blobs

How to fix

  1. In the Azure Portal, open Cost Management → Exports for your billing account, management group, or subscription.
  2. Confirm the export exists and is Enabled.
  3. In Storage Explorer or the Azure Portal, verify a recent .csv file is present in the target container.
  4. Confirm the App Registration has at least Storage Blob Data Reader or Owner access on the storage account.
  5. In Cloud View - Data#3, open Settings → Cloud Connections → Microsoft Azure and check the credential and cloud account status indicators.

3. Partial or Incomplete Data

When some subscriptions appear in dashboards but others don’t:

Possible causes

  • Role assignment missing on one or more subscriptions
  • Export configured only for part of your environment
  • Billing Scope export not configured for all required subscriptions
  • Subscription-level method selected without first confirming billing-scope CME availability

How to fix

  1. List all Azure subscriptions that should be included.
  2. For each, verify that the App Registration has the appropriate role:
    • Reader for CME and CDR access (plus storage roles for CME where required).
  3. Confirm your chosen import path is intentional:
    • Billing-scope CME (preferred), or
    • Subscription-scope CME / CDR when billing-scope CME is unavailable.

4. Historical Data Missing

Possible causes

  • Exports created recently (Azure does not backfill automatically)
  • Historical backfill still running (CME or CDR)
  • CSV retention too short in the storage container
  • Historical exports have not been run for manually setup exports

How to fix

  1. Wait up to 24 hours after initial connection for backfill to complete.
  2. In the Azure Portal, click on the export name and then '-> Export selected dates'. Historical exports should be for a single month per run.
  3. Increase retention or verify older CSV files are still available in storage.
  4. Cloud View - Data#3 will automatically identify and process historical exports during the next scheduled import.

5. Exports Not Updating Daily

Possible causes

  • Export schedule disabled in Azure
  • Storage quota reached or container deleted
  • Export failed due to transient Azure issue

How to fix

  1. In Azure Portal → Cost Management → Exports, verify the Schedule is set to Daily.
  2. Check for failed export runs in the Activity Log.
  3. Ensure the storage account is active and has available capacity.
  4. In Cloud View - Data#3, view Last Successful Import on the connection details page.

6. Permission or Access Denied Errors

Possible causes

  • Missing Reader role on subscriptions or management group
  • Conditional Access policies blocking service principal access
  • Client secret expired or revoked
  • Firewall or network rules blocking access

How to fix

  1. Verify the App Registration has Reader role assigned at the subscription or management group level.
  2. Check Certificates & secrets to confirm the client secret hasn't expired.
  3. Review any Conditional Access policies that may block service principal sign-ins.
  4. If using private endpoints or firewalls, ensure the App Registration can reach the required Azure APIs.
  5. Re-validate the connection in Cloud View - Data#3.

7. CDR reservation transaction expectations

If reservation actual transaction line items are required, use CME. CDR does not include reservation actual transaction rows.

8. CDR billing account 403 error (billing-account-scope CDR)

Symptom

The CDR importer logs a 403 error:

AzureCostManagementClient error 403: User does not have required permissions to view usage details by Billing Account for Billing Account: {billingAccountId}

This error only occurs with billing-account-scope CDR (when a Billing Account ID is configured on the cloud account). Subscription-scope CDR is unaffected.

Possible causes

  • Missing Billing account reader role on the MCA/EA billing account
  • Missing Cost Management Reader (Azure RBAC) at the subscription or tenant root scope
  • Billing account reader assigned but the POST generateCostDetailsReport action requires elevated billing permissions

How to fix

  1. In the Azure Portal, go to Cost Management + Billing and select the billing account from the error message.
  2. Click Access control (IAM) → Add → Add role assignment.
  3. Assign Billing account reader to your App Registration.
  4. Verify Cost Management Reader (Azure RBAC) is assigned at the tenant root or on a subscription within the billing account.
  5. Re-run the import in Cloud View - Data#3.
  6. If the 403 persists, escalate the billing account role to Billing account contributor — the POST action may require elevated billing permissions depending on the account configuration.

ℹ️ The billing account role is assigned on the billing account blade (Cost Management + Billing → IAM), not on a subscription. It is a billing-scoped role, separate from Azure RBAC.

See Application Registration & Permissions → Assign billing account role for full setup instructions.

9. Still Need Help?

If issues persist after these checks, please contact Cloud View - Data#3 support.

Include the following details for faster assistance:

  • Tenant ID
  • One affected Subscription ID
  • Date and time of your last successful export
  • Screenshot of the export configuration or error message

💡 Tip: Most data issues originate from missing permissions or disabled exports.
Re-validating your connection in Cloud View - Data#3 will usually detect and report any of these configuration gaps.