Microsoft Azure - Prerequisites - nOps Documentation

FAQs

What is the difference between EA and MCA billing accounts?

Enterprise Agreement (EA): A contract between your organization and Microsoft for large-scale Azure usage. EA billing accounts use numeric enrollment numbers (e.g., 12345678).
Microsoft Customer Agreement (MCA): A newer billing model available through Microsoft sales representatives or the Azure portal. MCA billing accounts use GUID-based IDs (e.g., 5e98e158-xxxx-xxxx-xxxx-xxxxxxxxxxxx:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_2019-05-31).

If you are unsure which type you have, go to Cost Management + Billing in the Azure Portal and check the Properties of your billing account.

What is a Management Group?

A Management Group is a container in Azure that helps you manage access, policies, and compliance across multiple subscriptions. All subscriptions within a management group automatically inherit the conditions applied to the management group, including RBAC role assignments.During setup, you give nOps the Reader role on a management group, so every subscription under it is covered, including subscriptions you add later.

Can I use the root management group?

Yes. If you want nOps to have visibility across all subscriptions in your tenant, use your Tenant ID as the Management Group ID. The root management group in Azure always matches the Tenant ID.

Overview

Integrate your Microsoft Azure environment with the nOps platform for comprehensive cost tracking, optimization recommendations, and commitment management. This integration uses Azure’s native RBAC system and FOCUS cost exports to provide full visibility into your Azure spending. nOps supports two onboarding tiers:

Savings Analysis — Read-only cost visibility, resource inventory, and optimization recommendations
Commitment Management — Automated purchasing and management of Azure Reservations and Savings Plans (requires Savings Analysis first)

What You’ll Need

Setup needs three kinds of roles. Different people on your team often hold them.

Microsoft Entra ID: Global Administrator or Privileged Role Administrator — to grant admin consent for the nOps.io app
Azure RBAC: Owner or User Access Administrator on the management group and on the export subscription — to assign roles to nOps.io. To create the export storage account, you also need Owner or Contributor on the export subscription
Billing role (Savings Analysis):
- MCA (default): Billing account owner on the MCA billing account — to assign the Billing account reader role to nOps.io and create the FOCUS export. Find who holds this role in Cost Management + Billing → select billing account → Access control (IAM).
- MCA, billing profiles option: if your organization only gives access to specific billing profiles, you can connect those instead. You need a Billing profile owner on each profile — to assign the Billing profile reader role to nOps.io and create a FOCUS export on each profile. Find who holds this role in Cost Management + Billing → select billing account → Billing profiles → select profile → Access control (IAM).
- EA: Enterprise Administrator on the EA enrollment — to assign the EnrollmentReader role to nOps.io and create the FOCUS export. Microsoft only lets an Enterprise Administrator with write access assign EA billing roles; Enterprise Administrator (read only), Department Administrator, and Account Owner cannot. Microsoft only supports assigning EA billing roles to a service principal through the REST API, not the Azure Portal. Find who holds this role in Cost Management + Billing → select your EA billing account → Access control (IAM).
Your Management Group ID — determines the scope of nOps visibility
An Azure Subscription — to hold the storage account for the FOCUS cost export. You create these resources yourself during setup
Knowledge of your Billing Account Type — Enterprise Agreement (EA) or Microsoft Customer Agreement (MCA)

Additional requirements for Commitment Management:

A dedicated Azure subscription for nOps reservation and savings plan purchases
EA: Enterprise Administrator on the EA enrollment — to assign the EA Purchaser role to nOps.io
MCA: Billing profile owner on the relevant MCA billing profile — to assign the Billing profile contributor role to nOps.io

Entra ID roles ≠ Azure RBAC roles ≠ billing roles. Being a Global Administrator in Microsoft Entra ID does not automatically give you permissions on Azure resources (subscriptions, management groups). Azure RBAC Owner doesn’t include billing roles either.

MCA: a Global Administrator can give themselves Billing account owner first. See Microsoft’s guide, Elevate access to manage billing accounts.
EA: a Global Administrator can’t give themselves EA billing roles. An Enterprise Administrator (not read only) must do the EA billing steps.

If you are a Global Admin but have never managed Azure resources, follow the steps below to enable Azure RBAC access.

Enabling Azure RBAC Access for Global Admins

Azure has three separate permission systems that are commonly confused:

System	What It Controls	Example Roles
Microsoft Entra ID roles	Identity, directory, and app registration management	Global Administrator, User Administrator
Azure RBAC roles	Azure resource operations (subscriptions, VMs, storage, etc.)	Owner, Contributor, Reader
Billing roles	Billing accounts, billing profiles, and EA enrollments	Billing account owner, Billing profile owner (MCA); Enterprise Administrator (EA)

The nOps setup requires Azure RBAC permissions (Owner or User Access Administrator) to assign roles to nOps.io. If you are a Global Administrator without Azure RBAC roles, you’ll need to enable elevated access. The steps below cover Azure RBAC only. For billing roles, see the warning above.

Enable Elevated Access

Go to Microsoft Entra ID > Properties in the Azure Portal
Find “Access management for Azure resources”
Toggle to Yes and click Save

This grants your Global Admin account the User Access Administrator role at the root scope, which cascades to all management groups and subscriptions.

Sign Out and Sign Back In

You must sign out of the Azure Portal and sign back in to pick up the new User Access Administrator role:

Click your profile picture in the top-right corner of the Azure Portal
Click Sign out
Navigate back to portal.azure.com and sign in again

Azure uses Continuous Access Evaluation (CAE) which may invalidate cached tokens when permissions change. After signing back in, if you still see permission errors, wait 2-3 minutes for the role to fully propagate.

Assign Yourself Owner on the Subscription

The User Access Administrator role only allows managing role assignments. You also need Owner to register resource providers and manage resources:

Go to Subscriptions in the Azure Portal
Select the subscription where you’ll run the nOps setup
Click Access control (IAM) in the left menu
Click Add > Add role assignment
In the Role tab, search for and select Owner
In the Members tab, click + Select members
Search for your email address and select your user account
Click Select, then Review + assign

Verify Access

To confirm you now have the necessary permissions:

Go to the subscription you just assigned Owner to
Click Access control (IAM) in the left menu
Click View my access (top button)
You should see both User Access Administrator (inherited from root) and Owner (subscription-level) listed

The first time you access Management Groups or run certain operations, Azure may automatically register resource providers like Microsoft.Management. This one-time operation can take 30-60 seconds.

For more details, see Microsoft’s documentation on Elevating access to manage all Azure subscriptions.

1. Understanding Billing Account Types

Your billing account type determines how nOps configures billing access. You must select the correct type during onboarding. Follow only the path that matches your agreement. EA and MCA are two separate setup paths.

Supported Billing Account Types: nOps supports Enterprise Agreement (EA) and Microsoft Customer Agreement (MCA) billing accounts only. If you have a Pay-As-You-Go (MOSP) subscription, please contact your Microsoft account representative to upgrade to an EA or MCA billing account before proceeding.

Path A: If you have an Enterprise Agreement (EA)

Use this path if your organization has a direct Enterprise Agreement with Microsoft. What you need:

EA Enrollment Number: A numeric ID (e.g., 12345678) that identifies your EA billing account. You will enter this in the nOps wizard in Get Started.
Where to find it: Go to Cost Management + Billing in the Azure Portal, select your Enterprise Agreement billing account, then open Settings > Properties and copy the Billing account ID. For an EA, the billing account ID is your enrollment number.
Billing hierarchy: Enrollment → Departments → Accounts → Subscriptions. nOps always connects at the enrollment (billing account) scope, for both the billing role and the FOCUS export. EA has no billing profile option.
How to confirm: In Cost Management + Billing, open your billing account → Settings > Properties. The Agreement type field must show “Enterprise Agreement”.

Path B: If you have a Microsoft Customer Agreement (MCA)

Use this path if your organization has a Microsoft Customer Agreement (the newer billing model, often via Microsoft sales or the Azure portal). What you need:

Billing Account: Your MCA billing account (GUID-style ID). You do not need to enter a numeric enrollment number. By default, nOps connects at your billing account (recommended), which covers every billing profile in it.
Billing profiles option: If your organization only gives access to specific billing profiles, you can connect those instead. You’ll enter your billing account ID and each billing profile ID in the nOps wizard, and you’ll need a Billing profile owner for each profile. Billing profiles you don’t add aren’t included in Savings Analysis.
Where to find it: Go to Cost Management + Billing in the Azure Portal and select your Microsoft Customer Agreement billing account. The billing account ID is under Properties. For a billing profile ID, open Billing profiles → select the profile → Properties. For Commitment Management, you will assign roles at the Billing Profile level.
Billing hierarchy: Billing Account → Billing Profiles → Invoice Sections → Subscriptions.
How to confirm: In Cost Management + Billing, open your billing account → Settings > Properties. The Agreement type field must show “Microsoft Customer Agreement”.

Quick reference: EA vs MCA

Feature	Enterprise Agreement (EA)	Microsoft Customer Agreement (MCA)
ID Format	Numeric enrollment number (e.g., `12345678`)	GUID format (e.g., `5e98e158-xxxx-..._2019-05-31`)
Billing Hierarchy	Enrollment > Departments > Accounts > Subscriptions	Billing Account > Billing Profiles > Invoice Sections > Subscriptions
Billing Role for nOps (Savings Analysis)	EnrollmentReader	Billing account reader (or Billing profile reader on each profile, with the billing profiles option)
How to Check	Properties show “Enterprise Agreement”	Properties show “Microsoft Customer Agreement”

2. Verifying You Do NOT Have a CSP Subscription

Cloud Solution Provider (CSP) subscriptions are NOT supported. nOps only works with direct Microsoft agreements (EA or MCA). If your Azure account is through a reseller or partner using the CSP program, you cannot use nOps.

A Cloud Solution Provider (CSP) is a Microsoft partner who resells Azure services. CSP subscriptions are billed through the partner, not directly by Microsoft. This creates a different billing structure that nOps does not currently support.

Recommended: run the nOps onboarding qualifier

The fastest way to confirm eligibility is the nOps onboarding qualifier, a read-only script that groups your subscriptions by billing account, classifies each as EA / MCA / Reseller / CSP, shows month-to-date spend, and prints an overall verdict. What it does, and does not do

It is completely read-only. It does not create, modify, deploy, or configure anything in your environment, and it does not grant nOps any access.
It reads only billing metadata (the billing account, profile, and agreement type each subscription belongs to) and month-to-date spend per subscription.
Nothing is transmitted anywhere. The script prints its results to your screen, and you decide what to share.

For spend figures, the account you sign in with needs Cost Management Reader (or Reader) at subscription scope. Without it, those subscriptions show n/a instead of a number, and the EA / MCA / CSP classification still works.

Run it in Azure Cloud Shell (about two minutes) Cloud Shell already has the Azure CLI and jq installed and is signed in as you, so there is nothing to install and no separate login.

Sign in to the Azure portal with an account that can view your billing (ideally whoever manages billing for your organization), confirm your organization’s directory is selected (top right), then open Cloud Shell with the >_ icon in the top toolbar. Choose Bash if prompted.

Add the script

Upload nops-onboarding-qualifier.sh (Manage files → Upload), or copy the script below and paste it into Cloud Shell.

Run it

Run bash nops-onboarding-qualifier.sh. It finishes in a few seconds. Add --csv results.csv to also write a CSV, --last-month for the previous month’s spend, or --help for all options.

Prefer your own terminal? With the Azure CLI and jq installed, run az login and then bash nops-onboarding-qualifier.sh.

nops-onboarding-qualifier.sh (click to expand)

#!/usr/bin/env bash
# === nOps onboarding qualifier ===
# Groups subscriptions by billing account -> profile, classifies each account
# EA / MCA / Reseller / CSP, shows spend, gives an onboard verdict. Read-only.
# Best run as the customer's billing admin, in their tenant.
#
# Hardened: portable (no md5sum), honest failures (n/a vs 0.00), preflight
# checks, RBAC caveat, safe arg parsing, mixed-currency flagging.
set -u
CSV=""; SKIP_COST=0; WINDOW="MonthToDate"
while [ $# -gt 0 ]; do case "$1" in
 --csv) [ $# -ge 2 ] || { echo "--csv needs a FILE argument" >&2; exit 1; }; CSV="$2"; shift 2;;
 --last-month) WINDOW="TheLastMonth"; shift;;
 --skip-cost) SKIP_COST=1; shift;;
 -h|--help) echo "Usage: $0 [--csv FILE] [--last-month] [--skip-cost]"; exit 0;;
 *) echo "unknown option: $1" >&2; exit 1;; esac; done

command -v jq >/dev/null || { echo "jq not found — install jq and retry" >&2; exit 1; }
command -v az >/dev/null || { echo "az (Azure CLI) not found — install it and run 'az login'" >&2; exit 1; }
az account show >/dev/null 2>&1 || { echo "not logged in — run 'az login' first" >&2; exit 1; }

D=$(mktemp -d) || { echo "mktemp -d failed" >&2; exit 1; }; trap 'rm -rf "$D"' EXIT; : > "$D/rows"; mkdir -p "$D/pc"

echo "Signed in as : $(az account show --query user.name -o tsv 2>/dev/null)"
echo "Tenant       : $(az account show --query tenantId -o tsv 2>/dev/null)"
echo "Note         : costs need Cost Management Reader (or Reader) at subscription scope;"
echo "               subscriptions without it show 'n/a', not 0.00."
echo "Qualifying..."

# billing accounts the signed-in identity has a billing role on (visibility flag)
az rest --method get \
 --url "https://management.azure.com/providers/Microsoft.Billing/billingAccounts?api-version=2024-04-01" 2>/dev/null \
 | jq -r '.value[]?.name' > "$D/visible" || true

BODY="{\"type\":\"ActualCost\",\"timeframe\":\"$WINDOW\",\"dataset\":{\"granularity\":\"None\",\"aggregation\":{\"totalCost\":{\"name\":\"Cost\",\"function\":\"Sum\"}}}}"

az account list --all --query "[?state=='Enabled'].{i:id,n:name}" -o tsv | while IFS=$'\t' read -r SUBID SUBNM; do
 BP=$(az rest --method get \
  --url "https://management.azure.com/subscriptions/$SUBID/providers/Microsoft.Billing/billingProperty/default?api-version=2024-04-01" 2>/dev/null)
 AG=$(echo "$BP" | jq -r '.properties.billingAccountAgreementType // ""')
 BA=$(echo "$BP" | jq -r '.properties.billingAccountDisplayName // "NO BILLING ACCESS"')
 BAID=$(echo "$BP" | jq -r '.properties.billingAccountId // ""')
 PROFID=$(echo "$BP" | jq -r '.properties.billingProfileId // ""')
 PROFD=$(echo "$BP" | jq -r '.properties.billingProfileDisplayName // "-"')
 PROFNM=$(printf '%s' "$PROFID" | sed -n 's#.*/billingProfiles/\([^/]*\).*#\1#p'); [ -z "$PROFNM" ] && PROFNM="-"

 REL=""; IND=""
 if [ "$AG" = "MicrosoftCustomerAgreement" ] && [ -n "$PROFID" ]; then
  # portable per-profile cache key (no md5sum: missing on stock macOS)
  CK="$D/pc/$(printf '%s' "$PROFID" | tr -c 'A-Za-z0-9' '_')"
  [ -f "$CK" ] || az rest --method get --url "https://management.azure.com${PROFID}?api-version=2024-04-01" 2>/dev/null \
    | jq -r '[(.properties.billingRelationshipType // ""),(.properties.indirectRelationshipInfo.displayName // "")]|@tsv' > "$CK" 2>/dev/null
  [ -s "$CK" ] && IFS=$'\t' read -r REL IND < "$CK"
 fi

 case "$AG" in
  EnterpriseAgreement)            TYPE="EA"; VR="OK";;
  MicrosoftPartnerAgreement)      TYPE="CSP"; VR="NO";;
  MicrosoftCustomerAgreement)
    if [ -n "$IND" ] || { [ -n "$REL" ] && [ "$REL" != "Direct" ]; }; then TYPE="Reseller"; VR="CHK";
    elif [ "$REL" = "Direct" ]; then TYPE="MCA"; VR="OK";
    else TYPE="MCA"; VR="CHK"; fi;;   # REL unconfirmed: could be indirect/reseller -> review, not auto-pass
  MicrosoftOnlineServicesProgram) TYPE="PAYG"; VR="CHK";;
  "")                             TYPE="?"; VR="CHK";;
  *)                              TYPE="$AG"; VR="CHK";;
 esac
 [ "$AG" = "MicrosoftCustomerAgreement" ] && [ "$TYPE" = "MCA" ] && [ -z "$REL" ] && IND="(direct/reseller unconfirmed)"

 ACCTSEG=$(printf '%s' "$BAID" | sed -n 's#.*/billingAccounts/\([^/]*\).*#\1#p')
 VIS="vis"; [ -n "$ACCTSEG" ] && ! grep -qxF "$ACCTSEG" "$D/visible" 2>/dev/null && VIS="hidden"

 if [ "$SKIP_COST" = 0 ]; then
  Q=$(az rest --method post \
   --url "https://management.azure.com/subscriptions/$SUBID/providers/Microsoft.CostManagement/query?api-version=2025-03-01" \
   --headers "Content-Type=application/json" --body "$BODY" 2>/dev/null)
  # empty COST = "couldn't read cost" (no access / API error), distinct from a real 0.00
  if [ $? -ne 0 ] || [ -z "$Q" ] || printf '%s' "$Q" | jq -e '.error' >/dev/null 2>&1; then
   COST=""; CUR="n/a"
  else
   COST=$(echo "$Q" | jq -r '(.properties.columns//[]) as $c|([ $c|to_entries[]|select(.value.name=="Cost" or .value.name=="PreTaxCost")|.key ]|first // 0) as $i|(.properties.rows[0][$i] // 0)' 2>/dev/null)
   CUR=$(echo "$Q" | jq -r '(.properties.columns//[]) as $c|([ $c|to_entries[]|select(.value.name=="Currency")|.key ]|first) as $i|(if $i!=null then (.properties.rows[0][$i] // "-") else "-" end)' 2>/dev/null)
   [ -z "$COST" ] && { COST=""; CUR="n/a"; }
  fi
 else COST=""; CUR="-"; fi

 printf "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n" \
  "$BA" "$BAID" "$TYPE" "$VR" "$PROFD" "$PROFNM" "$SUBNM" "$COST" "$CUR" "$IND" "$VIS" >> "$D/rows"
done

read -r OKA CHKA NOA <<<"$(awk -F'\t' '!s[$2]++{if($4=="OK")o++;else if($4=="NO")n++;else c++}END{print o+0,c+0,n+0}' "$D/rows")"
if [ "$OKA" -gt 0 ] && [ "$NOA" = 0 ] && [ "$CHKA" = 0 ]; then H="PASS — onboardable";
elif [ "$OKA" -gt 0 ]; then H="PARTIAL — some accounts onboardable, review the rest";
elif [ "$NOA" -gt 0 ] && [ "$OKA" = 0 ] && [ "$CHKA" = 0 ]; then H="FAIL — CSP/partner-billed, not supported";
else H="REVIEW — couldn't confirm billing control"; fi
echo; echo "VERDICT: $H"
echo " by billing account: OK $OKA onboardable   CHK $CHKA review   CSP/other $NOA unsupported"
echo

LC_ALL=C sort -t$'\t' -k2,2 -k6,6 -k8,8rn "$D/rows" | awk -F'\t' '
function cf(x, s,n,ip,d,sg,r,i,c){ s=sprintf("%.2f",x+0); n=index(s,"."); ip=substr(s,1,n-1); d=substr(s,n);
 if(substr(ip,1,1)=="-"){sg="-";ip=substr(ip,2)} r="";c=0; for(i=length(ip);i>=1;i--){r=substr(ip,i,1) r;c++; if(c%3==0&&i>1)r="," r} return sg r d }
function spend(seen,v,cur){ return (seen?cf(v):"n/a") (cur!=""?" " cur:"") }
BEGIN{ S="\001"; ca=S; cp=S }
{
 if($2!=ca){
  if(ca!=S){ printf "  profile spend: %s\n",spend(pseen,ps,pcur)
             printf " ACCOUNT SPEND: %s\n\n",spend(aseen,as,acur) }
  v=($4=="OK")?"✓ onboard":(($4=="NO")?"✗ not supported":"⚠ review")
  f=""; if($11=="hidden") f=f" (billing acct not visible to you)"
  if($3=="Reseller" && $10!="") f=f" via "$10
  if($3=="MCA" && $10!="") f=f" "$10
  idf=$2; sub(/^.*\/billingAccounts\//,"",idf); if(idf=="") idf="(no access)"
  printf "BILLING ACCOUNT: %s [%s] %s%s\n   id: %s\n",$1,$3,v,f,idf
  ca=$2; as=0; acur=""; aseen=0; cp=S
 }
 if($6!=cp){ if(cp!=S) printf "  profile spend: %s\n",spend(pseen,ps,pcur)
  printf " profile: %s\n",($6=="-"?$5:$6); cp=$6; ps=0; pcur=""; pseen=0 }
 printf "  %-40s %14s %s\n",substr($7,1,40),($8==""?"n/a":cf($8)),($8==""?"":($9=="-"?"":$9))
 if($8!=""){ ps+=$8; as+=$8; pseen=1; aseen=1;
  if($9!="-"&&$9!="n/a"){ if(pcur!=""&&pcur!=$9)pcur="MIXED"; else if(pcur!="MIXED")pcur=$9;
   if(acur!=""&&acur!=$9)acur="MIXED"; else if(acur!="MIXED")acur=$9 } }
}
END{ if(ca!=S){ printf "  profile spend: %s\n",spend(pseen,ps,pcur); printf " ACCOUNT SPEND: %s\n",spend(aseen,as,acur) } }'

if [ -n "$CSV" ]; then
 { echo "billing_account,billing_account_id,type,verdict,profile,profile_id,subscription,cost,currency,partner_or_note,visibility"
  LC_ALL=C sort "$D/rows" | awk -F'\t' 'BEGIN{OFS=","}{for(i=1;i<=NF;i++){gsub(/"/,"\"\"",$i); if($i~/[",]/)$i="\""$i"\""} print}'
 } > "$CSV"; echo; echo "CSV written to $CSV"
fi

Reading the verdict

Verdict	What it means
PASS	Every billing account is EA or direct MCA. You are good to proceed.
PARTIAL	Some accounts are onboardable; others need a closer look (reseller-billed MCA, or billing you cannot read).
FAIL	Only CSP / partner-billed accounts were found. Not supported.
REVIEW	Could not confirm billing control (often missing billing access). Re-run as a billing admin, or send the output to your nOps contact.

Each billing account is also flagged ✓ onboard, ✗ not supported, or ⚠ review in the output. If you are working with an nOps contact, you can share the output (or the CSV written by --csv results.csv) so they can confirm your billing scope. The easiest way is to copy everything the script printed, top to bottom, and paste it into your reply. Prefer not to run a script? You can check in the Azure Portal instead (below).

How to Check for CSP Subscriptions

The easiest way to verify you don’t have CSP subscriptions is through the Azure Marketplace eligibility checker:

Go to Private Offer Management

Navigate to Azure Portal → Marketplace → Private Offers Center

Click Check Eligibility

Click the Check Eligibility button on the right-hand side

Review the Results

Look for the eligibility check results. You should see:

✅ Green checkmark: “No Cloud Solution Provider (CSP) subscription found.” You can use nOps
❌ Red X: “Cloud Solution Provider (CSP) subscription found.” You cannot use nOps

If you find that you have CSP subscriptions, please contact your CSP reseller/partner for cost optimization solutions. You may need to migrate to a direct EA or MCA agreement with Microsoft if you want to use nOps in the future.

3. Finding Your Management Group ID

During setup, you give nOps the Reader role on a management group. This gives nOps visibility across all subscriptions in that group.

Go to Management Groups in the Azure Portal.
If you want nOps to see all subscriptions, use the Tenant Root Group — its ID matches your Tenant ID. In the nOps wizard, the Use tenant root button fills it in for you.
If you want to limit nOps to a subset of subscriptions, find the appropriate management group and note its ID.

If your organization does not use management groups, you can use your Tenant ID as the Management Group ID. This is equivalent to the root management group and covers all subscriptions.

4. Preparing a Subscription for FOCUS Exports

You will need an Azure subscription to hold the storage account for the FOCUS cost export. Choose the subscription with the most spend.

During setup, you create a resource group and a storage account in this subscription. The FOCUS export itself lives at your billing scope (billing account, enrollment, or billing profile) and writes its files to that storage account. nOps doesn’t create these resources. They cost only storage for the export files.

Required Resource Providers

For FOCUS Exports (on the export subscription)

These must be registered on the subscription where the storage account will be created:

Resource Provider	Purpose
`Microsoft.Storage`	Storage account for FOCUS export data
`Microsoft.CostManagement`	Cost queries and management
`Microsoft.CostManagementExports`	FOCUS export creation and scheduling

Portal
CLI

Go to Subscriptions > select your export subscription > Settings > Resource providers
Search for each provider above and click Register
Wait for all three to show Registered (1-2 minutes)

Run in Azure Cloud Shell:

az provider register --namespace Microsoft.Storage --subscription "<subscription-id>" && \
az provider register --namespace Microsoft.CostManagement --subscription "<subscription-id>" && \
az provider register --namespace Microsoft.CostManagementExports --subscription "<subscription-id>"

Most subscriptions already have Microsoft.Storage and Microsoft.CostManagement registered. Microsoft.CostManagementExports is the one most likely to require manual registration, especially on newer subscriptions.

For Commitment Management Only: Lighthouse (on the dedicated subscription)

Savings Analysis doesn’t use Azure Lighthouse. If you set up Commitment Management, Lighthouse requires Microsoft.ManagedServices to be registered on the dedicated subscription where you deploy it:

Resource Provider	Purpose
`Microsoft.ManagedServices`	Lighthouse delegated resource access

Portal
CLI

Go to Subscriptions > select the subscription > Settings > Resource providers
Search for Microsoft.ManagedServices, click Register

Run in Azure Cloud Shell:

az provider register --namespace Microsoft.ManagedServices --subscription "<subscription-id>"

Most subscriptions already have this registered. If it already shows “Registered”, no action is needed.

Storage Account Network Access

The nOps data ingestion service reads the exported cost data from outside Azure. If your organization enforces storage account firewalls via Azure Policy, allow the nOps IP addresses (44.246.45.84, 52.11.53.164, and 52.39.155.200) on the storage account after creation, and check “Allow Azure services on the trusted services list”.

5. Understanding RBAC Roles for nOps

nOps requires specific Azure RBAC roles to operate. These roles are assigned at different scopes depending on the integration tier.

Savings Analysis Roles (Read-Only)

Scope	Role	Role Definition ID	Purpose
Management Group	Reader	`acdd72a7-3385-48ef-bd42-f606fba81ae7`	View all subscriptions and their resources
Storage Account (FOCUS export)	Storage Blob Data Owner	`b7e6dc6d-f1e8-4753-8033-0f276bb0955b`	Read FOCUS export files from the storage account (data plane)

These two roles, plus one billing role below, are the complete list for Savings Analysis.

The Storage Blob Data Owner role is granted only on the storage account you create for the FOCUS export (nopsfocus<tenant-prefix>) — it does not grant access to any other resources in your environment. Savings Analysis does not need the Azure RBAC Owner role on the storage account. Owner is a management-plane role and cannot read blob data, so it does not replace Storage Blob Data Owner.

Billing Access Roles

Savings Analysis uses one of these billing roles:

Billing Account Type	Role Assigned	Role Definition ID	Scope	Who Can Assign It
Microsoft Customer Agreement (MCA), billing account (default)	Billing account reader	`50000000-aaaa-bbbb-cccc-100000000002`	Billing account	Billing account owner (Azure Portal)
Microsoft Customer Agreement (MCA), billing profiles option	Billing profile reader	`40000000-aaaa-bbbb-cccc-100000000002`	Each selected billing profile	Billing profile owner of each profile (Azure Portal)
Enterprise Agreement (EA)	EnrollmentReader	`24f8edb6-1668-4659-b5e2-40bb5f3a7d7e`	Billing account (enrollment)	Enterprise Administrator (REST API only)

Commitment Management Roles (Additional)

These roles are added on top of Savings Analysis roles when you upgrade to Commitment Management. Savings Analysis doesn’t use any of them:

Scope	Role	Role Definition ID	Purpose
Management Group	Cost Management Contributor	`434105ed-43f6-45c7-a02f-909b2ba83430`	Query cost data
Management Group	Monitoring Reader	`43d0d8ad-25c7-4714-9337-8ba259a9fe05`	View monitoring metrics and diagnostics
Tenant (`/providers/Microsoft.Capacity`)	Reservations Contributor	`b4ebc951-a0c2-41f7-a3cd-a57fe27c8e3a`	Read and manage reservations (programmatic + Portal)
Tenant (`/providers/Microsoft.BillingBenefits`)	Savings Plan Contributor	`28c0d4cd-558d-4de9-91a0-faa18e7b3266`	Read and manage savings plans (programmatic + Portal)
Dedicated Subscription (via Lighthouse)	Reservations Purchaser	`f7b75c60-3036-4b75-91c3-6b41c27c1689`	Purchase reservations on the dedicated subscription
Dedicated Subscription (via Lighthouse)	Savings Plan Purchaser	`3d24a3a0-c154-4f6f-a5ed-adc8e01ddb74`	Purchase savings plans on the dedicated subscription
Storage Account	Owner	`8e3af657-a8ff-443c-a75c-2fe8c4bcb635`	Commitment Management setup verification on the FOCUS export storage account. Keep Storage Blob Data Owner as well, because Owner cannot read blob data
Billing Account (EA)	EA Purchaser	`da6647fb-7651-49ee-be91-c43c4877f0c4`	Purchase via EA billing. Assigned by an Enterprise Administrator (REST API only)
Billing Profile (MCA)	Billing profile contributor	(built-in)	Purchase via MCA billing

6. Purchase Policies (Commitment Management Only)

If you plan to use Commitment Management for reservation and savings plan purchases, your billing account must have purchase policies enabled. Without these, only billing administrators can make purchases. Users with the Reservations Purchaser RBAC role (including those delegated via Azure Lighthouse) will be blocked.

Billing Account Type	Policy Location	Setting
Enterprise Agreement (EA)	Enrollment > Settings > Policies	Reserved Instances must be On
Microsoft Customer Agreement (MCA)	Billing Profile > Policies	Azure Reservation purchases must be Yes
Microsoft Customer Agreement (MCA)	Billing Profile > Policies	Azure Savings Plan must be Yes

For MCA, only the billing profile associated with the dedicated subscription needs these policies enabled. You do not need to change policies on other billing profiles.

Next Steps

Once you have your Management Group ID, know your billing account type, have a subscription ready for FOCUS exports, and know who on your team holds each required role, you are ready to connect Azure to nOps.

Ready to connect? Go to nOps Settings > Cloud Provider Integrations and click the Microsoft Azure card to start the integration wizard.

nOps offers two onboarding tiers. Start with Savings Analysis, then upgrade to Commitment Management when ready:

Savings Analysis Setup

Read-only cost visibility, resource inventory, optimization recommendations, and daily FOCUS cost exports.

Commitment Management Setup

Automated purchasing and management of Azure Reservations and Savings Plans. Requires Savings Analysis first.

Getting Started

Cloud provider integrations

Platform

Clara

Inform

AI

Operate

Optimize

Third-Party Integrations

Telemetry

Plugins

Portfolio Portal

Support

Microsoft Azure - Prerequisites

FAQs

Overview

What You’ll Need

Enabling Azure RBAC Access for Global Admins

1. Understanding Billing Account Types

Path A: If you have an Enterprise Agreement (EA)

Path B: If you have a Microsoft Customer Agreement (MCA)

Quick reference: EA vs MCA

2. Verifying You Do NOT Have a CSP Subscription

Recommended: run the nOps onboarding qualifier

How to Check for CSP Subscriptions

3. Finding Your Management Group ID

4. Preparing a Subscription for FOCUS Exports

Required Resource Providers

For FOCUS Exports (on the export subscription)

For Commitment Management Only: Lighthouse (on the dedicated subscription)

Storage Account Network Access

5. Understanding RBAC Roles for nOps

Savings Analysis Roles (Read-Only)

Billing Access Roles

Commitment Management Roles (Additional)

6. Purchase Policies (Commitment Management Only)

Next Steps

Savings Analysis Setup

Commitment Management Setup

​FAQs

​Overview

​What You’ll Need

​Enabling Azure RBAC Access for Global Admins

​1. Understanding Billing Account Types

​Path A: If you have an Enterprise Agreement (EA)

​Path B: If you have a Microsoft Customer Agreement (MCA)

​Quick reference: EA vs MCA

​2. Verifying You Do NOT Have a CSP Subscription

​Recommended: run the nOps onboarding qualifier

​How to Check for CSP Subscriptions

​3. Finding Your Management Group ID

​4. Preparing a Subscription for FOCUS Exports

​Required Resource Providers

​For FOCUS Exports (on the export subscription)

​For Commitment Management Only: Lighthouse (on the dedicated subscription)

​Storage Account Network Access

​5. Understanding RBAC Roles for nOps

​Savings Analysis Roles (Read-Only)

​Billing Access Roles

​Commitment Management Roles (Additional)

​6. Purchase Policies (Commitment Management Only)

​Next Steps

Savings Analysis Setup

Commitment Management Setup

FAQs

Overview

What You’ll Need

Enabling Azure RBAC Access for Global Admins

1. Understanding Billing Account Types

Path A: If you have an Enterprise Agreement (EA)

Path B: If you have a Microsoft Customer Agreement (MCA)

Quick reference: EA vs MCA

2. Verifying You Do NOT Have a CSP Subscription

Recommended: run the nOps onboarding qualifier

How to Check for CSP Subscriptions

3. Finding Your Management Group ID

4. Preparing a Subscription for FOCUS Exports

Required Resource Providers

For FOCUS Exports (on the export subscription)

For Commitment Management Only: Lighthouse (on the dedicated subscription)

Storage Account Network Access

5. Understanding RBAC Roles for nOps

Savings Analysis Roles (Read-Only)

Billing Access Roles

Commitment Management Roles (Additional)

6. Purchase Policies (Commitment Management Only)

Next Steps