Microsoft Azure

Overview

nOps offers two integration tiers, each requiring different levels of access:

Savings Analysis — Read-only cost visibility, resource inventory, and optimization recommendations
Commitment Management — Automated purchasing and management of Azure Reservations and Savings Plans (builds on Savings Analysis)

Cloud Solution Provider (CSP) subscriptions are NOT supported. nOps only works with direct Microsoft agreements — Enterprise Agreement (EA) or Microsoft Customer Agreement (MCA).

Permissions — Savings Analysis

Management Group Scope

Role	Role Definition ID	Purpose
Reader	`acdd72a7-3385-48ef-bd42-f606fba81ae7`	View all resources across subscriptions
Cost Management Contributor	`434105ed-43f6-45c7-a02f-909b2ba83430`	Query cost data, create and manage FOCUS exports
Monitoring Reader	`43d0d8ad-25c7-4714-9337-8ba259a9fe05`	View monitoring metrics and diagnostics

Storage Account Scope

Role	Role Definition ID	Purpose
Owner	`8e3af657-a8ff-443c-a75c-2fe8c4bcb635`	Manage the FOCUS export storage account
Storage Blob Data Reader	(built-in)	Read blob data from FOCUS cost exports

The Owner role is granted exclusively on the storage account created by nOps for FOCUS exports (nopsfocus<tenant-prefix>) — it does not grant Owner access to any other resources in your environment.

Tenant Scope

Scope	Role	Role Definition ID	Purpose
`/providers/Microsoft.Capacity`	Reservations Reader	`582fc458-8989-419f-a480-75249bc5db7e`	Read all reservations in the tenant
`/providers/Microsoft.BillingBenefits`	Savings Plan Reader	`d534ad90-4ac5-4815-a178-b2e47397baab`	Read all savings plans in the tenant

Billing Account Scope

Billing Account Type	Role	Role Definition ID	Purpose
Enterprise Agreement (EA)	EnrollmentReader	`24f8edb6-1668-4659-b5e2-40bb5f3a7d7e`	Read enrollment-level billing data
Microsoft Customer Agreement (MCA)	Billing Account Reader	(built-in)	Read billing account data

Permissions — Commitment Management

These additional roles are assigned on top of Savings Analysis.

Tenant Scope (Additional)

Scope	Role	Role Definition ID	Purpose
`/providers/Microsoft.Capacity`	Reservations Contributor	`b4ebc951-a0c2-41f7-a3cd-a57fe27c8e3a`	Read and manage reservations
`/providers/Microsoft.BillingBenefits`	Savings Plan Contributor	`28c0d4cd-558d-4de9-91a0-faa18e7b3266`	Read and manage savings plans

Dedicated Subscription Scope (via Lighthouse)

Role	Role Definition ID	Purpose
Reservations Purchaser	`f7b75c60-3036-4b75-91c3-6b41c27c1689`	Purchase reservations on the dedicated subscription
Savings Plan Purchaser	`3d24a3a0-c154-4f6f-a5ed-adc8e01ddb74`	Purchase savings plans on the dedicated subscription

Billing Account Scope (Additional)

Billing Account Type	Role	Role Definition ID	Purpose
Enterprise Agreement (EA)	EA Purchaser	`da6647fb-7651-49ee-be91-c43c4877f0c4`	Purchase reservations and savings plans via EA billing
Microsoft Customer Agreement (MCA)	Billing Profile Contributor	(built-in)	Purchase reservations and savings plans via MCA billing

Complete Role Summary

All roles at a glance (Savings Analysis + Commitment Management)

Scope	Role	Savings Analysis	Commitment Management
Management Group	Reader	Yes	(inherited)
Management Group	Cost Management Contributor	Yes	(inherited)
Management Group	Monitoring Reader	Yes	(inherited)
Storage Account	Owner	Yes	(inherited)
Storage Account	Storage Blob Data Reader	Yes	(inherited)
Tenant (Reservations)	Reservations Reader	Yes	Upgraded to Contributor
Tenant (Savings Plans)	Savings Plan Reader	Yes	Upgraded to Contributor
Tenant (Reservations)	Reservations Contributor	—	Yes
Tenant (Savings Plans)	Savings Plan Contributor	—	Yes
Dedicated Subscription	Reservations Purchaser	—	Yes
Dedicated Subscription	Savings Plan Purchaser	—	Yes
Billing Account (EA)	EnrollmentReader	Yes	(inherited)
Billing Account (EA)	EA Purchaser	—	Yes
Billing Account (MCA)	Billing Account Reader	Yes	(inherited)
Billing Profile (MCA)	Billing Profile Contributor	—	Yes

Resources Created by nOps

During the integration setup, nOps creates the following resources in your Azure environment.

Service Principal

Created automatically by Azure AD when you grant admin consent for the nOps application. This is the identity used to access your Azure resources.

FOCUS Export Resources

Created in the Azure subscription you designate during setup.

Resource	Name	Location
Resource Group	`nops-focus-exports-rg`	East US
Storage Account	`nopsfocus<tenant-prefix>`	East US
FOCUS Cost Export	`nops-clara-focus-export`	(billing scope)

These resources incur minimal cost — only storage fees for the exported cost data.

Lighthouse Delegations

Resource	Scope	Tier
Lighthouse delegation (read-only)	Management Group	Savings Analysis
Lighthouse delegation (purchasing)	Dedicated Subscription	Commitment Management
Azure Policy assignment	Management Group	Savings Analysis

Required Resource Providers

FOCUS Export Subscription

Resource Provider	Purpose
`Microsoft.Storage`	Storage account for FOCUS export data
`Microsoft.CostManagement`	Cost queries and management
`Microsoft.CostManagementExports`	FOCUS export creation and scheduling

All Subscriptions (Lighthouse & Policy)

Resource Provider	Purpose
`Microsoft.ManagedServices`	Lighthouse delegated resource access
`Microsoft.PolicyInsights`	Policy compliance evaluation and remediation

Required Purchase Policies

Required for Commitment Management only.

Billing Account Type	Policy Location	Setting	Required Value
Enterprise Agreement (EA)	Enrollment > Settings > Policies	Reserved Instances	On
Microsoft Customer Agreement (MCA)	Billing Profile > Policies	Azure Reservation purchases	Yes
Microsoft Customer Agreement (MCA)	Billing Profile > Policies	Azure Savings Plan	Yes

Network Requirements

If your organization enforces storage account firewalls, whitelist the following nOps IP addresses on the FOCUS export storage account:

IP Address
`44.246.45.84`
`52.11.53.164`
`52.39.155.200`

Also ensure “Allow Azure services on the trusted services list” is enabled on the storage account firewall.

If your storage account allows public network access (the default), no firewall configuration is needed.

Prerequisites

Prepare your Azure environment for nOps onboarding.

Savings Analysis Setup

Step-by-step guide to connect Azure for read-only cost visibility.

Commitment Management Setup

Configure automated purchasing of Azure Reservations and Savings Plans.

Getting Started

Platform

Clara

Inform

Operate

Optimize

Third-Party Integrations

Plugins

Google Cloud Platform

Amazon Web Services

Support

Microsoft Azure - Permissions & Resources

Overview

Permissions — Savings Analysis

Management Group Scope

Storage Account Scope

Tenant Scope

Billing Account Scope

Permissions — Commitment Management

Tenant Scope (Additional)

Dedicated Subscription Scope (via Lighthouse)

Billing Account Scope (Additional)

Complete Role Summary

Resources Created by nOps

Service Principal

FOCUS Export Resources

Lighthouse Delegations

Required Resource Providers

FOCUS Export Subscription

All Subscriptions (Lighthouse & Policy)

Required Purchase Policies

Network Requirements

Prerequisites

Savings Analysis Setup

Commitment Management Setup

​Overview

​Permissions — Savings Analysis

​Management Group Scope

​Storage Account Scope

​Tenant Scope

​Billing Account Scope

​Permissions — Commitment Management

​Tenant Scope (Additional)

​Dedicated Subscription Scope (via Lighthouse)

​Billing Account Scope (Additional)

​Complete Role Summary

​Resources Created by nOps

​Service Principal

​FOCUS Export Resources

​Lighthouse Delegations

​Required Resource Providers

​FOCUS Export Subscription

​All Subscriptions (Lighthouse & Policy)

​Required Purchase Policies

​Network Requirements

​Related Guides

Prerequisites

Savings Analysis Setup

Commitment Management Setup

Overview

Permissions — Savings Analysis

Management Group Scope

Storage Account Scope

Tenant Scope

Billing Account Scope

Permissions — Commitment Management

Tenant Scope (Additional)

Dedicated Subscription Scope (via Lighthouse)

Billing Account Scope (Additional)

Complete Role Summary

Resources Created by nOps

Service Principal

FOCUS Export Resources

Lighthouse Delegations

Required Resource Providers

FOCUS Export Subscription

All Subscriptions (Lighthouse & Policy)

Required Purchase Policies

Network Requirements

Related Guides