> ## Documentation Index
> Fetch the complete documentation index at: https://help.nops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Azure - Commitment Management Setup

> Configure nOps to manage Azure Reservations and Savings Plans on your behalf, including automated purchasing and optimization.

## FAQs

<AccordionGroup>
  <Accordion title="What is Azure Commitment Management?">
    Azure Commitment Management enables nOps to autonomously purchase, manage, and optimize Azure Reservations and Savings Plans on your behalf. This includes monitoring utilization, recommending optimal commitment levels, and executing purchases when savings opportunities are identified.
  </Accordion>

  <Accordion title="What is the difference between Reservations and Savings Plans?">
    * **Reservations**: Discounts applied to specific resource types (e.g., Virtual Machines, SQL Database) in specific regions. Offer the highest savings (up to 72%) but are less flexible.
    * **Savings Plans**: Discounts applied based on a per-hour spend commitment, covering a broader range of compute services. More flexible than reservations but may offer slightly lower savings.

    nOps manages both types to maximize your overall savings.
  </Accordion>

  <Accordion title="Why do I need a dedicated subscription?">
    A dedicated subscription isolates nOps commitment management resources from your production workloads. This provides:

    * **Clear auditing**: Easily identify nOps-managed purchases in billing reports
    * **Separation of concerns**: Keep commitment infrastructure separate from workloads
    * **Simplified permissions**: Grant nOps elevated roles only in the dedicated subscription
  </Accordion>

  <Accordion title="Do reservations purchased in one subscription apply to others?">
    Yes. Azure Reservations can be scoped to **Shared** scope, which applies the discount to eligible resources across **all subscriptions** in the billing account. nOps configures purchases with shared scope by default.
  </Accordion>

  <Accordion title="What billing roles are needed for purchasing?">
    * **EA**: The **EA Purchaser** role at the enrollment (billing account) level is required to purchase reservations and savings plans.
    * **MCA**: The **Billing Profile Contributor** role at the billing profile level is required for purchases.

    These roles are assigned during the Commitment Management setup.
  </Accordion>

  <Accordion title="Why does verification show a 'purchase policies' check?">
    After you assign the purchasing roles, nOps automatically reads your billing account policies to confirm that reservation and savings plan purchases are allowed. This is a separate gate from having the correct roles — your billing administrator may have disabled these purchase types at the policy level.

    * **EA**: The **Reserved Instances** policy under your EA enrollment must be set to **On**.
    * **MCA**: The **Azure Reservation purchases** and **Azure Savings Plan** policies on your billing profile must both be set to **Yes**.

    If the check fails, go to **Cost Management + Billing > Settings > Policies** for your billing account or billing profile and enable the relevant options.
  </Accordion>

  <Accordion title="Do I need Inform to view Commitment Inventory?">
    No. [Commitment Inventory](/optimize/commitment-inventory) is included on every nOps plan when your Azure integration is **active**. Inform is only required to **email** or **schedule** inventory reports. This CM setup is for purchasing and reservation inventory reads—not for opening the Inventory page itself.
  </Accordion>
</AccordionGroup>

***

## Overview

**Commitment Management** is the second tier of Azure onboarding. It builds on top of [Savings Analysis](/azure/integration-setup) and gives nOps the ability to:

* Purchase and manage Azure **Reservations** on your behalf
* Purchase and manage Azure **Savings Plans** on your behalf
* Monitor utilization and optimize commitment levels
* Execute purchases when savings opportunities are identified

<Warning>
  **Savings Analysis is required first.** Commitment Management adds elevated permissions on top of an existing Savings Analysis integration. If you haven't set up Savings Analysis yet, complete the [Savings Analysis Setup](/azure/integration-setup) first.
</Warning>

<Info>
  **Prerequisites** -- Before configuring Commitment Management, ensure you have completed:

  * [Azure Integration Prerequisites](/azure/prerequisites) -- Billing account type, management group setup
  * [Azure Savings Analysis Setup](/azure/integration-setup) -- Read-only integration with verified Savings Analysis
  * **EA only:** Your EA Enrollment Number (provided during Savings Analysis setup) -- find it in [Cost Management + Billing](https://portal.azure.com/#blade/Microsoft_Azure_GTM/ModernBillingMenuBlade) in the Azure Portal
  * **MCA only:** A **Billing Profile Owner** on the relevant MCA billing profile must complete the Billing Profile Contributor assignment in Step B below. This is a billing-scope role, separate from Entra ID and Azure RBAC

  You will need the nOps Savings Analysis integration already verified and working. You can find it in [nOps Settings > Cloud Provider Integrations](https://clara.nops.io/settings) -- look for the **Enable CM** button on your Azure integration.
</Info>

***

## Permission Upgrade Path

Commitment Management requires elevated permissions beyond the Savings Analysis integration. The table below summarizes the additional roles needed.

| Scope                                   | Savings Analysis (Read-Only)                           | Commitment Management (Purchasing)                                          |
| --------------------------------------- | ------------------------------------------------------ | --------------------------------------------------------------------------- |
| Tenant Provider Scope                   | Reservations Reader, Savings Plan Reader               | Reservations Contributor, Savings Plan Contributor (supersede Reader roles) |
| Billing Account (EA)                    | EnrollmentReader                                       | + EA Purchaser                                                              |
| Billing Account (MCA)                   | Billing Account Reader                                 | + Billing Profile Contributor                                               |
| Management Group                        | Reader, Cost Management Contributor, Monitoring Reader | (inherited from SA)                                                         |
| Dedicated Subscription (via Lighthouse) | --                                                     | + Reservations Purchaser, Savings Plan Purchaser (Portal access)            |

***

## Step 1: Create a Dedicated Subscription

nOps requires a dedicated Azure subscription for commitment management operations. This subscription serves as the central location for nOps-managed resources.

<Info>
  **Why a Dedicated Subscription?**

  * **Centralized Operations**: nOps uses this subscription for commitment-related operations
  * **Clear Ownership**: Easily identify and audit nOps-managed resources
  * **Simplified IAM**: Grant nOps elevated roles only in this subscription, following least-privilege principles
  * **Separation of Concerns**: Keep commitment management separate from your workload subscriptions
</Info>

1. Go to [**Subscriptions**](https://portal.azure.com/#view/Microsoft_Azure_Billing/SubscriptionsBlade) in the Azure Portal.
2. Click **+ Add** to create a new subscription.
3. Enter the following details:
   * **Subscription name**: Any name you like (we suggest `nOps-FinOps` for easy identification)
   * **Billing account**: Select your billing account
   * **Management group**: Place it under your management group so RBAC roles are inherited
4. Click **Create**.
5. Copy the **Subscription ID** -- you will need it in the nOps wizard.

<Warning>
  Make sure the dedicated subscription is placed **under your management group** so that the Savings Analysis RBAC roles (Reader, Cost Management Contributor, etc.) are automatically inherited.
</Warning>

***

## Step 2: Upgrade to Commitment Management in nOps

After completing the Savings Analysis verification, the nOps wizard displays an **Enable CM** button.

<Steps>
  <Step title="Open the Integration Wizard">
    Go to [**nOps Settings > Cloud Provider Integrations**](https://clara.nops.io/settings). Find your verified Azure integration and click **Enable CM**.
  </Step>

  <Step title="Enter the Dedicated Subscription ID">
    Enter the **Subscription ID** of the dedicated nOps subscription you created in Step 1. This subscription will be used for commitment management operations.
  </Step>

  <Step title="Click Continue">
    nOps generates the setup with the additional commitment management roles.
  </Step>
</Steps>

***

## Step 3: Run the Commitment Management Setup

The Commitment Management setup assigns additional roles beyond the Savings Analysis integration. For complete role definitions, see [Prerequisites - Understanding RBAC Roles for nOps](/azure/prerequisites#5-understanding-rbac-roles-for-nops).

### Additional Roles Assigned

Commitment Management adds the following roles to your existing Savings Analysis integration:

* **A. Tenant Provider Scope:** Reservations Contributor, Savings Plan Contributor
* **B. Billing Account:** EA Purchaser (EA) or Billing Profile Contributor (MCA)
* **C. Purchase Policies:** Verified to allow RBAC-based purchases
* **D. Dedicated Subscription (via Lighthouse):** Reservations Purchaser, Savings Plan Purchaser (Portal access)

For complete role definitions, purposes, and role IDs, see [Prerequisites - Understanding RBAC Roles for nOps](/azure/prerequisites#5-understanding-rbac-roles-for-nops).

### Running the Setup

Complete the Commitment Management upgrade through the Azure Portal UI with visual confirmation at each step.

<Info>
  The nOps wizard walks you through these same steps (labeled **A** through **D**). Follow along in the wizard or use the instructions below.
</Info>

**A. Assign Tenant-Level Reservation and Savings Plan Contributor Roles**

These roles are assigned at the tenant provider scope and grant read/manage access to all reservations and savings plans. You must be a **Global Administrator** with elevated access to assign them.

<Warning>
  **Prerequisite:** You must enable **"Access management for Azure resources"** in Microsoft Entra ID before you can assign tenant-level roles. Go to [**Microsoft Entra ID → Properties**](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Properties), toggle **"Access management for Azure resources"** to **Yes**, click **Save**, then **sign out** and **sign back in** to pick up the new permissions.
</Warning>

<Steps>
  <Step title="Assign Reservations Contributor">
    1. Go to [**Reservations**](https://portal.azure.com/#view/Microsoft_Azure_Reservations/ReservationsBrowseBlade) in the Azure Portal
    2. Click the **Role Assignment** button in the top toolbar
    3. Click **Add**, select the **Reservations Contributor** role
    4. Search for **"nOps.io"**, select it, then click **Save**
  </Step>

  <Step title="Assign Savings Plan Contributor">
    1. Go to [**Reservations → Savings Plans**](https://portal.azure.com/#view/Microsoft_Azure_Reservations/ReservationsBrowseBlade/productType/SavingsPlan) in the Azure Portal
    2. Click **Role Assignment** in the top toolbar
    3. Click **Add** → **Add role assignment**
    4. Search for **Savings Plan Contributor**, assign to **"nOps.io"**
  </Step>
</Steps>

**B. Assign Billing Purchasing Role**

The specific billing role depends on your billing account type. **Choose your path:** follow only the **EA** or **MCA** tab below according to your billing type.

<Tabs>
  <Tab title="Path A: Enterprise Agreement (EA)">
    <Warning>
      Azure does **not** support assigning EA billing roles (such as EA Purchaser) to service principals through the Azure Portal. These roles can only be assigned programmatically via the REST API. Use the script below in [Azure Cloud Shell](https://shell.azure.com) (Bash, not PowerShell) or a local terminal with the Azure CLI installed.
    </Warning>

    <Steps>
      <Step title="Sign in to Azure CLI">
        Open [Azure Cloud Shell](https://shell.azure.com) (Bash) or run `az login` in your local terminal.
      </Step>

      <Step title="Run the EA Purchaser assignment script">
        Copy and run the following script. Replace `<enrollment-number>` and `<tenant-id>` with your values (the nOps wizard pre-fills these in its generated script):

        ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
        # Assign EA Purchaser role to nOps service principal
        # Run in Azure Cloud Shell (Bash, not PowerShell) or a local terminal with Azure CLI

        NOPS_APP_CLIENT_ID="<app-client-id>"

        # Look up the nOps service principal Object ID
        NOPS_SP_OBJECT_ID=$(az ad sp show --id "$NOPS_APP_CLIENT_ID" --query "id" -o tsv 2>/dev/null || true)

        if [ -z "$NOPS_SP_OBJECT_ID" ]; then
          echo "ERROR: nOps service principal not found. Complete the Admin Consent step first."
          exit 1
        fi

        echo "Found nOps service principal: $NOPS_SP_OBJECT_ID"

        ROLE_ASSIGNMENT_GUID=$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid)

        az rest --method PUT \
          --url "https://management.azure.com/providers/Microsoft.Billing/billingAccounts/<enrollment-number>/billingRoleAssignments/${ROLE_ASSIGNMENT_GUID}?api-version=2024-04-01" \
          --body '{
            "properties": {
              "principalId": "'"$NOPS_SP_OBJECT_ID"'",
              "principalTenantId": "<tenant-id>",
              "roleDefinitionId": "/providers/Microsoft.Billing/billingAccounts/<enrollment-number>/billingRoleDefinitions/da6647fb-7651-49ee-be91-c43c4877f0c4"
            }
          }'

        echo "Done. A 200 OK response confirms the EA Purchaser role was assigned."
        ```

        <Tip>
          The nOps wizard generates a ready-to-run script with all values pre-filled (App Client ID, enrollment number, and tenant ID). Copy it directly from the wizard for the easiest experience.
        </Tip>

        <Info>
          **Fallback:** If `az ad sp show` fails, you can find the service principal manually: `az ad sp list --filter "startswith(displayName, 'nops')" --query "[].{name:displayName, objectId:id}" -o table` and use the **objectId** value.
        </Info>

        A `200 OK` response confirms the role was assigned successfully.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Path B: Microsoft Customer Agreement (MCA)">
    <Warning>
      **You must be a Billing Profile Owner** on the relevant MCA billing profile to complete this step. **Global Administrator** and **Azure RBAC Owner** do **not** grant billing-scope permissions. If you don't have this role, ask your Billing Profile Owner to complete this step. Check who holds this role in [**Cost Management + Billing**](https://portal.azure.com/#blade/Microsoft_Azure_GTM/ModernBillingMenuBlade) → select billing account → **Billing profiles** → select profile → **Access control (IAM)**.
    </Warning>

    <Steps>
      <Step title="Navigate to Billing Profile">
        Go to [**Cost Management + Billing**](https://portal.azure.com/#blade/Microsoft_Azure_GTM/ModernBillingMenuBlade), select your **Microsoft Customer Agreement** billing account, then navigate to **Billing** → **Billing profiles** and select your billing profile.
      </Step>

      <Step title="Assign Billing Profile Contributor">
        1. Click **Access control (IAM)** in the left menu
        2. Click **Add** at the top
        3. Select role: **Billing Profile Contributor**
        4. Under **"Users, groups, or apps"**, search for **"nOps.io"** and select it
        5. Click **Review + assign**
      </Step>

      <Step title="Repeat for Additional Profiles">
        If you have multiple billing profiles, repeat the process for each one where nOps should be able to make purchases.
      </Step>
    </Steps>
  </Tab>
</Tabs>

**C. Verify Purchase Policies**

Your billing account policies must allow reservation and savings plan purchases for users with RBAC roles. If these policies are disabled, only billing administrators can make purchases. **Choose your path:** follow only the **EA** or **MCA** tab that matches your billing type.

<Tabs>
  <Tab title="Path A: Enterprise Agreement (EA)">
    <Steps>
      <Step title="Navigate to EA Policies">
        Go to [**Cost Management + Billing**](https://portal.azure.com/#view/Microsoft_Azure_GTM/ModernBillingMenuBlade/~/Overview). Select your Enterprise Agreement enrollment, then go to **Settings** > **Policies**.
      </Step>

      <Step title="Enable Reserved Instances">
        Verify **Reserved Instances** is set to **On**. This allows users with the Reservations Contributor role to make reservation purchases.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Path B: Microsoft Customer Agreement (MCA)">
    <Steps>
      <Step title="Navigate to Billing Profile Policies">
        Go to [**Cost Management + Billing**](https://portal.azure.com/#view/Microsoft_Azure_GTM/ModernBillingMenuBlade) → In the left menu, scroll down to **Billing** and select **Billing profiles**. Select the billing profile associated with your dedicated subscription.
      </Step>

      <Step title="Open Policies">
        Click **Settings** → **Policies** in the left menu.
      </Step>

      <Step title="Enable Purchase Policies">
        Verify the following are set to **Yes**:

        * **Azure Reservation purchases** — allows users with subscription access to buy Azure Reservations
        * **Azure Savings Plan** — allows users with subscription access to buy Azure Savings Plans

        Click **Save** if you made changes.
      </Step>
    </Steps>

    <Info>
      When these policies are disabled, only Billing Account Owners and Billing Profile Owners can purchase reservations and savings plans — users with the Reservations Contributor role would be blocked from making purchases.
    </Info>
  </Tab>
</Tabs>

**D. Deploy Lighthouse for Portal Purchases**

Deploy Azure Lighthouse on the **dedicated subscription** to allow nOps team members to manage commitment purchases (reservations and savings plans) via the Azure Portal.

<Warning>
  **Register Resource Providers First** -- New subscriptions have no resource providers registered by default. Register all of the following on your dedicated subscription before deploying:

  Go to [**Subscriptions → Resource providers**](https://portal.azure.com/#view/Microsoft_Azure_Billing/SubscriptionsBlade) and click **Register** on each: `Microsoft.ManagedServices`, `Microsoft.Storage`, `Microsoft.CostManagement`, `Microsoft.CostManagementExports`.
</Warning>

<Steps>
  <Step title="Note the Operators Security Group ID">
    The nOps wizard provides this pre-filled value: `672b3e07-66e9-426e-860e-0957d8b9186d`. You will use it in the template deployment.
  </Step>

  <Step title="Deploy the Lighthouse ARM Template">
    Use the **Deploy to Azure** link in the nOps setup wizard, or go to [Deploy a custom template](https://portal.azure.com/#create/Microsoft.Template) in the Azure Portal and paste the Lighthouse template.
  </Step>

  <Step title="Complete the Deployment">
    1. Select the **nOps dedicated subscription** from the **Subscription** dropdown.
    2. Click **Next**.
    3. Click **Review + create**, then **Create** to deploy.
  </Step>
</Steps>

**Return to nOps**

Once you have completed all the steps above (A through D), return to the nOps wizard and click **"I've Completed the Manual Setup"** to proceed to verification.

***

## Step 4: Verify Commitment Management Permissions

After completing the setup, verify that all commitment management permissions are correctly configured.

<Steps>
  <Step title="Wait for Role Propagation">
    Azure role assignments typically take **2-5 minutes** to propagate. Wait for the cooldown timer in the nOps wizard to complete.
  </Step>

  <Step title="Click Verify Permissions">
    The wizard validates both the Savings Analysis roles and the additional Commitment Management roles:

    * **Reservations Contributor** — Can the service principal read and manage reservations?
    * **Savings Plan Contributor** — Can the service principal read and manage savings plans?
    * **Billing access** — Does the service principal have the correct billing-level purchasing permissions?
    * **Lighthouse deployment** — Is the Portal purchase access deployed on the dedicated subscription?
  </Step>

  <Step title="Review Results">
    If all checks pass, you will see an **"All Permissions Verified"** confirmation. The integration is now fully configured for automated commitment management.

    <Info>
      **Purchase policy check:** The verification automatically reads your billing account policies and reports whether **Azure Reservation purchases** and **Azure Savings Plan** purchases are allowed. If either shows as blocked, revisit [Step 3: Verify Purchase Policies](#step-3-run-the-commitment-management-setup) to enable them in your billing account or billing profile settings.
    </Info>
  </Step>
</Steps>

***

## Summary of Roles

For a complete reference of all RBAC roles required for Azure integration, including role definition IDs and detailed purposes, see [Prerequisites - Understanding RBAC Roles for nOps](/azure/prerequisites#5-understanding-rbac-roles-for-nops).

**Commitment Management includes:**

* All Savings Analysis roles (read-only access to resources, costs, and billing)
* Tenant-level roles: Reservations Contributor, Savings Plan Contributor (supersede the SA Reader roles -- Contributor includes read access)
* Dedicated subscription roles via Lighthouse: Reservations Purchaser, Savings Plan Purchaser (Portal purchasing)
* Billing roles: EA Purchaser or Billing Profile Contributor

***

## Additional Resources

* [Azure Reservations Overview](https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/save-compute-costs-reservations)
* [Azure Savings Plans Overview](https://learn.microsoft.com/en-us/azure/cost-management-billing/savings-plan/savings-plan-compute-overview)
* [Azure RBAC Built-in Roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles)
* [Azure Cost Management Exports](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-export-acm-data)