> ## Documentation Index
> Fetch the complete documentation index at: https://help.nops.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft Azure - Permissions & Resources
> Complete reference of all permissions nOps requires and all resources nOps creates in your Azure environment.
## Overview
nOps offers two integration tiers, each requiring different levels of access:
1. **[Savings Analysis](/azure/integration-setup)** -- Read-only cost visibility, resource inventory, and optimization recommendations
2. **[Commitment Management](/azure/commitment-management-setup)** -- Automated purchasing and management of Azure Reservations and Savings Plans (builds on Savings Analysis)
**Cloud Solution Provider (CSP) subscriptions are NOT supported.** nOps only works with direct Microsoft agreements -- Enterprise Agreement (EA) or Microsoft Customer Agreement (MCA).
***
## Permissions -- Savings Analysis
### Management Group Scope
| Role | Role Definition ID | Purpose |
| --------------------------- | -------------------------------------- | ------------------------------------------------ |
| Reader | `acdd72a7-3385-48ef-bd42-f606fba81ae7` | View all resources across subscriptions |
| Cost Management Contributor | `434105ed-43f6-45c7-a02f-909b2ba83430` | Query cost data, create and manage FOCUS exports |
| Monitoring Reader | `43d0d8ad-25c7-4714-9337-8ba259a9fe05` | View monitoring metrics and diagnostics |
### Storage Account Scope
| Role | Role Definition ID | Purpose |
| ------------------------ | -------------------------------------- | --------------------------------------- |
| Owner | `8e3af657-a8ff-443c-a75c-2fe8c4bcb635` | Manage the FOCUS export storage account |
| Storage Blob Data Reader | (built-in) | Read blob data from FOCUS cost exports |
The **Owner** role is granted exclusively on the storage account created by nOps for FOCUS exports (`nopsfocus`) -- it does not grant Owner access to any other resources in your environment.
### Tenant Scope
| Scope | Role | Role Definition ID | Purpose |
| -------------------------------------- | ------------------- | -------------------------------------- | ------------------------------------ |
| `/providers/Microsoft.Capacity` | Reservations Reader | `582fc458-8989-419f-a480-75249bc5db7e` | Read all reservations in the tenant |
| `/providers/Microsoft.BillingBenefits` | Savings Plan Reader | `d534ad90-4ac5-4815-a178-b2e47397baab` | Read all savings plans in the tenant |
### Billing Account Scope
| Billing Account Type | Role | Role Definition ID | Purpose |
| ---------------------------------- | ---------------------- | -------------------------------------- | ---------------------------------- |
| Enterprise Agreement (EA) | EnrollmentReader | `24f8edb6-1668-4659-b5e2-40bb5f3a7d7e` | Read enrollment-level billing data |
| Microsoft Customer Agreement (MCA) | Billing Account Reader | (built-in) | Read billing account data |
***
## Permissions -- Commitment Management
These additional roles are assigned on top of Savings Analysis.
### Tenant Scope (Additional)
| Scope | Role | Role Definition ID | Purpose |
| -------------------------------------- | ------------------------ | -------------------------------------- | ----------------------------- |
| `/providers/Microsoft.Capacity` | Reservations Contributor | `b4ebc951-a0c2-41f7-a3cd-a57fe27c8e3a` | Read and manage reservations |
| `/providers/Microsoft.BillingBenefits` | Savings Plan Contributor | `28c0d4cd-558d-4de9-91a0-faa18e7b3266` | Read and manage savings plans |
### Dedicated Subscription Scope (via Lighthouse)
| Role | Role Definition ID | Purpose |
| ---------------------- | -------------------------------------- | ---------------------------------------------------- |
| Reservations Purchaser | `f7b75c60-3036-4b75-91c3-6b41c27c1689` | Purchase reservations on the dedicated subscription |
| Savings Plan Purchaser | `3d24a3a0-c154-4f6f-a5ed-adc8e01ddb74` | Purchase savings plans on the dedicated subscription |
### Billing Account Scope (Additional)
| Billing Account Type | Role | Role Definition ID | Purpose |
| ---------------------------------- | --------------------------- | -------------------------------------- | ------------------------------------------------------- |
| Enterprise Agreement (EA) | EA Purchaser | `da6647fb-7651-49ee-be91-c43c4877f0c4` | Purchase reservations and savings plans via EA billing |
| Microsoft Customer Agreement (MCA) | Billing Profile Contributor | (built-in) | Purchase reservations and savings plans via MCA billing |
### Complete Role Summary
| Scope | Role | Savings Analysis | Commitment Management |
| ---------------------- | --------------------------- | :--------------: | :---------------------: |
| Management Group | Reader | Yes | (inherited) |
| Management Group | Cost Management Contributor | Yes | (inherited) |
| Management Group | Monitoring Reader | Yes | (inherited) |
| Storage Account | Owner | Yes | (inherited) |
| Storage Account | Storage Blob Data Reader | Yes | (inherited) |
| Tenant (Reservations) | Reservations Reader | Yes | Upgraded to Contributor |
| Tenant (Savings Plans) | Savings Plan Reader | Yes | Upgraded to Contributor |
| Tenant (Reservations) | Reservations Contributor | -- | Yes |
| Tenant (Savings Plans) | Savings Plan Contributor | -- | Yes |
| Dedicated Subscription | Reservations Purchaser | -- | Yes |
| Dedicated Subscription | Savings Plan Purchaser | -- | Yes |
| Billing Account (EA) | EnrollmentReader | Yes | (inherited) |
| Billing Account (EA) | EA Purchaser | -- | Yes |
| Billing Account (MCA) | Billing Account Reader | Yes | (inherited) |
| Billing Profile (MCA) | Billing Profile Contributor | -- | Yes |
***
## Resources Created by nOps
During the integration setup, nOps creates the following resources in your Azure environment.
### Service Principal
Created automatically by Azure AD when you grant admin consent for the nOps application. This is the identity used to access your Azure resources.
### FOCUS Export Resources
Created in the Azure subscription you designate during setup.
| Resource | Name | Location |
| ----------------- | -------------------------- | --------------- |
| Resource Group | `nops-focus-exports-rg` | East US |
| Storage Account | `nopsfocus` | East US |
| FOCUS Cost Export | `nops-clara-focus-export` | (billing scope) |
These resources incur minimal cost -- only storage fees for the exported cost data.
### Lighthouse Delegations
| Resource | Scope | Tier |
| ---------------------------------- | ---------------------- | --------------------- |
| Lighthouse delegation (read-only) | Management Group | Savings Analysis |
| Lighthouse delegation (purchasing) | Dedicated Subscription | Commitment Management |
| Azure Policy assignment | Management Group | Savings Analysis |
***
## Required Resource Providers
### FOCUS Export Subscription
| Resource Provider | Purpose |
| --------------------------------- | ------------------------------------- |
| `Microsoft.Storage` | Storage account for FOCUS export data |
| `Microsoft.CostManagement` | Cost queries and management |
| `Microsoft.CostManagementExports` | FOCUS export creation and scheduling |
### All Subscriptions (Lighthouse & Policy)
| Resource Provider | Purpose |
| --------------------------- | -------------------------------------------- |
| `Microsoft.ManagedServices` | Lighthouse delegated resource access |
| `Microsoft.PolicyInsights` | Policy compliance evaluation and remediation |
***
## Required Purchase Policies
Required for **Commitment Management** only.
| Billing Account Type | Policy Location | Setting | Required Value |
| ---------------------------------- | -------------------------------- | --------------------------- | -------------- |
| Enterprise Agreement (EA) | Enrollment > Settings > Policies | Reserved Instances | **On** |
| Microsoft Customer Agreement (MCA) | Billing Profile > Policies | Azure Reservation purchases | **Yes** |
| Microsoft Customer Agreement (MCA) | Billing Profile > Policies | Azure Savings Plan | **Yes** |
***
## Network Requirements
If your organization enforces storage account firewalls, whitelist the following nOps IP addresses on the FOCUS export storage account:
| IP Address |
| --------------- |
| `44.246.45.84` |
| `52.11.53.164` |
| `52.39.155.200` |
Also ensure **"Allow Azure services on the trusted services list"** is enabled on the storage account firewall.
If your storage account allows public network access (the default), no firewall configuration is needed.
***
## Related Guides
Prepare your Azure environment for nOps onboarding.
Step-by-step guide to connect Azure for read-only cost visibility.
Configure automated purchasing of Azure Reservations and Savings Plans.