Skip to main content

​
Overview

nOps offers two integration tiers, each requiring different levels of access:
  1. Savings Analysis — Read-only cost visibility, resource inventory, and optimization recommendations
  2. Commitment Management — Automated purchasing and management of Azure Reservations and Savings Plans (builds on Savings Analysis)
Cloud Solution Provider (CSP) subscriptions are NOT supported. nOps only works with direct Microsoft agreements — Enterprise Agreement (EA) or Microsoft Customer Agreement (MCA).

​
Permissions — Savings Analysis

Savings Analysis uses three roles: Reader, Storage Blob Data Owner, and one billing role. That’s the complete list. You assign all of them to nOps.io during Run the Setup.

​
Management Group Scope

​
Storage Account Scope

The Storage Blob Data Owner role is granted only on the storage account you create for the FOCUS export (nopsfocus<tenant-prefix>) — it does not grant access to any other resources in your environment. Savings Analysis does not need the Azure RBAC Owner role on the storage account. Owner is a management-plane role and cannot read blob data.

​
Billing Scope

You assign one of these, depending on your billing account type and how you connect it: These billing roles are read-only. nOps can’t change billing settings or make purchases with them.
Not used by Savings Analysis: Cost Management Contributor, Monitoring Reader, Reservations Reader, Savings Plan Reader, Owner on the storage account, Azure Lighthouse, and Azure Policy. (Commitment Management uses Lighthouse.)

​
Permissions — Commitment Management

Commitment Management adds one Azure Lighthouse delegation on each purchase subscription, the subscription each reservation or savings plan is billed to. nOps staff buy in the Azure portal through it, signed in to the nOps tenant. Nothing is added at the tenant, billing, or storage level, or for the nOps.io application.

​
Purchase Subscription Scope (nOps Commitment Management delegation)

The delegation gives the nOps Customer Access Operators group in the nOps tenant (9a93f7e1-76f9-4a8d-a15e-5eeb73cf1d18) these roles:
  • EA: one subscription in your enrollment.
  • MCA: one subscription in each billing profile nOps buys for (shared commitments apply per billing profile).
Any active subscription under the management group you connected works, including one that already has commitments. If you’d rather keep purchasing apart from your workloads, use an empty one. You can see or remove the delegation under Service providers in the Azure portal.
Billing account or billing profile? Visibility is granted once, at the billing account: the Billing account reader role from Savings Analysis covers every billing profile, including new ones. Buying is per billing profile. Microsoft requires Owner or Reservation Purchaser on the subscription a purchase is billed to, even for billing account owners, and a shared commitment covers only that subscription’s billing profile. No billing account role replaces the purchase subscription in each profile.Commitment Management Verify also uses Billing account reader to check which billing profile each purchase subscription bills to. On a billing account connection, Verify fails if it can’t.
Where purchases live. A reservation or savings plan nOps staff buy is created in the nOps tenant and owned by the buyer, so nOps can exchange or refund the reservations it buys. It’s billed to your purchase subscription and applies to your resources. If you stop using nOps, nOps moves your reservations to your tenant; savings plans can’t change tenant.
Not used by Commitment Management: purchaser roles for nOps.io, Reservations Administrator or Savings Plan Reader at the tenant, EA Purchaser, Billing account or profile contributor, Cost Management Contributor, Monitoring Reader, and Owner on the storage account.

​
Complete Role Summary

​
Resources in Your Environment

Admin consent adds the nOps.io enterprise application to your tenant. You create everything else yourself during setup: the FOCUS export resources for Savings Analysis, and for Commitment Management the Lighthouse delegation on each purchase subscription. When you grant admin consent, Microsoft adds the nOps.io enterprise application (a service principal) to your Microsoft Entra ID tenant. This is the identity nOps uses to connect to Azure. It isn’t an app registration: the nOps app registration lives in nOps’s own tenant. Consent by itself gives nOps no access to your subscriptions, billing, or storage. nOps only gets access from the roles you assign.

​
FOCUS Export Resources (created by you)

You create these in the Azure portal during Step C of the setup. nOps doesn’t create them.
These resources cost only the storage for the exported cost data.

​
Required Resource Providers

​
FOCUS Export Subscription

​
Required Purchase Policies

Required for Commitment Management only. Verify reads these through the reservationPurchases and savingsPlanPurchases billing policy properties. When nOps can’t read them, Verify shows a note instead of failing.

​
Network Requirements

If your organization enforces storage account firewalls, whitelist the following nOps IP addresses on the FOCUS export storage account: Also ensure “Allow Azure services on the trusted services list” is enabled on the storage account firewall.
If your storage account allows public network access (the default), no firewall configuration is needed.

Prerequisites

Prepare your Azure environment for nOps onboarding.

Savings Analysis Setup

Step-by-step guide to connect Azure for read-only cost visibility.

Commitment Management Setup

Configure automated purchasing of Azure Reservations and Savings Plans.