Microsoft Azure

FAQs

What is Azure Commitment Management?

Azure Commitment Management enables nOps to autonomously purchase, manage, and optimize Azure Reservations and Savings Plans on your behalf. This includes monitoring utilization, recommending optimal commitment levels, and executing purchases when savings opportunities are identified.

What is the difference between Reservations and Savings Plans?

Reservations: Discounts applied to specific resource types (e.g., Virtual Machines, SQL Database) in specific regions. Offer the highest savings (up to 72%) but are less flexible.
Savings Plans: Discounts applied based on a per-hour spend commitment, covering a broader range of compute services. More flexible than reservations but may offer slightly lower savings.

nOps manages both types to maximize your overall savings.

Why do I need a dedicated subscription?

A dedicated subscription isolates nOps commitment management resources from your production workloads. This provides:

Clear auditing: Easily identify nOps-managed purchases in billing reports
Separation of concerns: Keep commitment infrastructure separate from workloads
Simplified permissions: Grant nOps elevated roles only in the dedicated subscription

Do reservations purchased in one subscription apply to others?

Yes. Azure Reservations can be scoped to Shared scope, which applies the discount to eligible resources across all subscriptions in the billing account. nOps configures purchases with shared scope by default.

What billing roles are needed for purchasing?

EA: The EA Purchaser role at the enrollment (billing account) level is required to purchase reservations and savings plans.
MCA: The Billing Profile Contributor role at the billing profile level is required for purchases.

These roles are assigned during the Commitment Management setup.

Why does verification show a 'purchase policies' check?

After you assign the purchasing roles, nOps automatically reads your billing account policies to confirm that reservation and savings plan purchases are allowed. This is a separate gate from having the correct roles — your billing administrator may have disabled these purchase types at the policy level.

EA: The Reserved Instances policy under your EA enrollment must be set to On.
MCA: The Azure Reservation purchases and Azure Savings Plan policies on your billing profile must both be set to Yes.

If the check fails, go to Cost Management + Billing > Settings > Policies for your billing account or billing profile and enable the relevant options.

Do I need Inform to view Commitment Inventory?

No. Commitment Inventory is included on every nOps plan when your Azure integration is active. Inform is only required to email or schedule inventory reports. This CM setup is for purchasing and reservation inventory reads—not for opening the Inventory page itself.

Overview

Commitment Management is the second tier of Azure onboarding. It builds on top of Savings Analysis and gives nOps the ability to:

Purchase and manage Azure Reservations on your behalf
Purchase and manage Azure Savings Plans on your behalf
Monitor utilization and optimize commitment levels
Execute purchases when savings opportunities are identified

Savings Analysis is required first. Commitment Management adds elevated permissions on top of an existing Savings Analysis integration. If you haven’t set up Savings Analysis yet, complete the Savings Analysis Setup first.

Prerequisites — Before configuring Commitment Management, ensure you have completed:

Azure Integration Prerequisites — Billing account type, management group setup
Azure Savings Analysis Setup — Read-only integration with verified Savings Analysis
EA only: Your EA Enrollment Number (provided during Savings Analysis setup) — find it in Cost Management + Billing in the Azure Portal
MCA only: A Billing Profile Owner on the relevant MCA billing profile must complete the Billing Profile Contributor assignment in Step B below. This is a billing-scope role, separate from Entra ID and Azure RBAC

You will need the nOps Savings Analysis integration already verified and working. You can find it in nOps Settings > Cloud Provider Integrations — look for the Enable CM button on your Azure integration.

Permission Upgrade Path

Commitment Management requires elevated permissions beyond the Savings Analysis integration. The table below summarizes the additional roles needed.

Scope	Savings Analysis (Read-Only)	Commitment Management (Purchasing)
Tenant Provider Scope	Reservations Reader, Savings Plan Reader	Reservations Contributor, Savings Plan Contributor (supersede Reader roles)
Billing Account (EA)	EnrollmentReader	+ EA Purchaser
Billing Account (MCA)	Billing Account Reader	+ Billing Profile Contributor
Management Group	Reader, Cost Management Contributor, Monitoring Reader	(inherited from SA)
Dedicated Subscription (via Lighthouse)	—	+ Reservations Purchaser, Savings Plan Purchaser (Portal access)

Step 1: Create a Dedicated Subscription

nOps requires a dedicated Azure subscription for commitment management operations. This subscription serves as the central location for nOps-managed resources.

Why a Dedicated Subscription?

Centralized Operations: nOps uses this subscription for commitment-related operations
Clear Ownership: Easily identify and audit nOps-managed resources
Simplified IAM: Grant nOps elevated roles only in this subscription, following least-privilege principles
Separation of Concerns: Keep commitment management separate from your workload subscriptions

Go to Subscriptions in the Azure Portal.
Click + Add to create a new subscription.
Enter the following details:
- Subscription name: Any name you like (we suggest nOps-FinOps for easy identification)
- Billing account: Select your billing account
- Management group: Place it under your management group so RBAC roles are inherited
Click Create.
Copy the Subscription ID — you will need it in the nOps wizard.

Make sure the dedicated subscription is placed under your management group so that the Savings Analysis RBAC roles (Reader, Cost Management Contributor, etc.) are automatically inherited.

Step 2: Upgrade to Commitment Management in nOps

After completing the Savings Analysis verification, the nOps wizard displays an Enable CM button.

Open the Integration Wizard

Go to nOps Settings > Cloud Provider Integrations. Find your verified Azure integration and click Enable CM.

Enter the Dedicated Subscription ID

Enter the Subscription ID of the dedicated nOps subscription you created in Step 1. This subscription will be used for commitment management operations.

Click Continue

nOps generates the setup with the additional commitment management roles.

Step 3: Run the Commitment Management Setup

The Commitment Management setup assigns additional roles beyond the Savings Analysis integration. For complete role definitions, see Prerequisites - Understanding RBAC Roles for nOps.

Additional Roles Assigned

Commitment Management adds the following roles to your existing Savings Analysis integration:

A. Tenant Provider Scope: Reservations Contributor, Savings Plan Contributor
B. Billing Account: EA Purchaser (EA) or Billing Profile Contributor (MCA)
C. Purchase Policies: Verified to allow RBAC-based purchases
D. Dedicated Subscription (via Lighthouse): Reservations Purchaser, Savings Plan Purchaser (Portal access)

For complete role definitions, purposes, and role IDs, see Prerequisites - Understanding RBAC Roles for nOps.

Running the Setup

Complete the Commitment Management upgrade through the Azure Portal UI with visual confirmation at each step.

The nOps wizard walks you through these same steps (labeled A through D). Follow along in the wizard or use the instructions below.

A. Assign Tenant-Level Reservation and Savings Plan Contributor Roles These roles are assigned at the tenant provider scope and grant read/manage access to all reservations and savings plans. You must be a Global Administrator with elevated access to assign them.

Prerequisite: You must enable “Access management for Azure resources” in Microsoft Entra ID before you can assign tenant-level roles. Go to Microsoft Entra ID → Properties, toggle “Access management for Azure resources” to Yes, click Save, then sign out and sign back in to pick up the new permissions.

Assign Reservations Contributor

Go to Reservations in the Azure Portal
Click the Role Assignment button in the top toolbar
Click Add, select the Reservations Contributor role
Search for “nOps.io”, select it, then click Save

Assign Savings Plan Contributor

Go to Reservations → Savings Plans in the Azure Portal
Click Role Assignment in the top toolbar
Click Add → Add role assignment
Search for Savings Plan Contributor, assign to “nOps.io”

B. Assign Billing Purchasing Role The specific billing role depends on your billing account type. Choose your path: follow only the EA or MCA tab below according to your billing type.

Path A: Enterprise Agreement (EA)
Path B: Microsoft Customer Agreement (MCA)

Azure does not support assigning EA billing roles (such as EA Purchaser) to service principals through the Azure Portal. These roles can only be assigned programmatically via the REST API. Use the script below in Azure Cloud Shell (Bash, not PowerShell) or a local terminal with the Azure CLI installed.

Open Azure Cloud Shell (Bash) or run az login in your local terminal.

Run the EA Purchaser assignment script

Copy and run the following script. Replace <enrollment-number> and <tenant-id> with your values (the nOps wizard pre-fills these in its generated script):

# Assign EA Purchaser role to nOps service principal
# Run in Azure Cloud Shell (Bash, not PowerShell) or a local terminal with Azure CLI

NOPS_APP_CLIENT_ID="<app-client-id>"

# Look up the nOps service principal Object ID
NOPS_SP_OBJECT_ID=$(az ad sp show --id "$NOPS_APP_CLIENT_ID" --query "id" -o tsv 2>/dev/null || true)

if [ -z "$NOPS_SP_OBJECT_ID" ]; then
  echo "ERROR: nOps service principal not found. Complete the Admin Consent step first."
  exit 1
fi

echo "Found nOps service principal: $NOPS_SP_OBJECT_ID"

ROLE_ASSIGNMENT_GUID=$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid)

az rest --method PUT \
  --url "https://management.azure.com/providers/Microsoft.Billing/billingAccounts/<enrollment-number>/billingRoleAssignments/${ROLE_ASSIGNMENT_GUID}?api-version=2024-04-01" \
  --body '{
    "properties": {
      "principalId": "'"$NOPS_SP_OBJECT_ID"'",
      "principalTenantId": "<tenant-id>",
      "roleDefinitionId": "/providers/Microsoft.Billing/billingAccounts/<enrollment-number>/billingRoleDefinitions/da6647fb-7651-49ee-be91-c43c4877f0c4"
    }
  }'

echo "Done. A 200 OK response confirms the EA Purchaser role was assigned."

The nOps wizard generates a ready-to-run script with all values pre-filled (App Client ID, enrollment number, and tenant ID). Copy it directly from the wizard for the easiest experience.

Fallback: If az ad sp show fails, you can find the service principal manually: az ad sp list --filter "startswith(displayName, 'nops')" --query "[].{name:displayName, objectId:id}" -o table and use the objectId value.

A 200 OK response confirms the role was assigned successfully.

C. Verify Purchase Policies Your billing account policies must allow reservation and savings plan purchases for users with RBAC roles. If these policies are disabled, only billing administrators can make purchases. Choose your path: follow only the EA or MCA tab that matches your billing type.

Path A: Enterprise Agreement (EA)
Path B: Microsoft Customer Agreement (MCA)

Navigate to EA Policies

Go to Cost Management + Billing. Select your Enterprise Agreement enrollment, then go to Settings > Policies.

Enable Reserved Instances

Verify Reserved Instances is set to On. This allows users with the Reservations Contributor role to make reservation purchases.

D. Deploy Lighthouse for Portal Purchases Deploy Azure Lighthouse on the dedicated subscription to allow nOps team members to manage commitment purchases (reservations and savings plans) via the Azure Portal.

Register Resource Providers First — New subscriptions have no resource providers registered by default. Register all of the following on your dedicated subscription before deploying:Go to Subscriptions → Resource providers and click Register on each: Microsoft.ManagedServices, Microsoft.Storage, Microsoft.CostManagement, Microsoft.CostManagementExports.

Note the Operators Security Group ID

The nOps wizard provides this pre-filled value: 672b3e07-66e9-426e-860e-0957d8b9186d. You will use it in the template deployment.

Deploy the Lighthouse ARM Template

Use the Deploy to Azure link in the nOps setup wizard, or go to Deploy a custom template in the Azure Portal and paste the Lighthouse template.

Complete the Deployment

Select the nOps dedicated subscription from the Subscription dropdown.
Click Next.
Click Review + create, then Create to deploy.

Return to nOps Once you have completed all the steps above (A through D), return to the nOps wizard and click “I’ve Completed the Manual Setup” to proceed to verification.

Step 4: Verify Commitment Management Permissions

After completing the setup, verify that all commitment management permissions are correctly configured.

Wait for Role Propagation

Azure role assignments typically take 2-5 minutes to propagate. Wait for the cooldown timer in the nOps wizard to complete.

Click Verify Permissions

The wizard validates both the Savings Analysis roles and the additional Commitment Management roles:

Reservations Contributor — Can the service principal read and manage reservations?
Savings Plan Contributor — Can the service principal read and manage savings plans?
Billing access — Does the service principal have the correct billing-level purchasing permissions?
Lighthouse deployment — Is the Portal purchase access deployed on the dedicated subscription?

Review Results

If all checks pass, you will see an “All Permissions Verified” confirmation. The integration is now fully configured for automated commitment management.

Purchase policy check: The verification automatically reads your billing account policies and reports whether Azure Reservation purchases and Azure Savings Plan purchases are allowed. If either shows as blocked, revisit Step 3: Verify Purchase Policies to enable them in your billing account or billing profile settings.

Summary of Roles

For a complete reference of all RBAC roles required for Azure integration, including role definition IDs and detailed purposes, see Prerequisites - Understanding RBAC Roles for nOps. Commitment Management includes:

All Savings Analysis roles (read-only access to resources, costs, and billing)
Tenant-level roles: Reservations Contributor, Savings Plan Contributor (supersede the SA Reader roles — Contributor includes read access)
Dedicated subscription roles via Lighthouse: Reservations Purchaser, Savings Plan Purchaser (Portal purchasing)
Billing roles: EA Purchaser or Billing Profile Contributor

Getting Started

Platform

Clara

Inform

Operate

Optimize

Third-Party Integrations

Plugins

Google Cloud Platform

Amazon Web Services

Support

Microsoft Azure - Commitment Management Setup

FAQs

Overview

Permission Upgrade Path

Step 1: Create a Dedicated Subscription

Step 2: Upgrade to Commitment Management in nOps

Step 3: Run the Commitment Management Setup

Additional Roles Assigned

Running the Setup

Step 4: Verify Commitment Management Permissions

Summary of Roles

Additional Resources

​FAQs

​Overview

​Permission Upgrade Path

​Step 1: Create a Dedicated Subscription

​Step 2: Upgrade to Commitment Management in nOps

​Step 3: Run the Commitment Management Setup

​Additional Roles Assigned

​Running the Setup

​Step 4: Verify Commitment Management Permissions

​Summary of Roles

​Additional Resources

FAQs

Overview

Permission Upgrade Path

Step 1: Create a Dedicated Subscription

Step 2: Upgrade to Commitment Management in nOps

Step 3: Run the Commitment Management Setup

Additional Roles Assigned

Running the Setup

Step 4: Verify Commitment Management Permissions

Summary of Roles

Additional Resources