> For the complete documentation index, see [llms.txt](https://docs.cloud-halo.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloud-halo.io/azure-setup/permissions-required.md). # Azure permissions required Cloud Halo is designed to use read-only Azure access. Cloud Halo does not need permission to create, modify, or delete Azure resources. ## Minimum access At minimum, Cloud Halo needs access that allows it to read Azure cost data for the subscriptions you want to monitor. Assign the following Azure role at the subscription scope: * Cost Management Reader This role lets Cloud Halo read cost and usage data for the subscription. ## Recommended additional read-only access Depending on your Azure setup, Cloud Halo may also need or benefit from: * Reader, for resource metadata, resource groups, tags, and resource-level context * Billing Reader, for billing account or agreement-level cost visibility The exact requirement can vary depending on whether your organisation uses Enterprise Agreement, Microsoft Customer Agreement, Cloud Solution Provider, or standard subscription billing. ## Enterprise Application consent With the Enterprise Application flow, an Azure administrator approves Cloud Halo for the tenant. After consent is granted, you still need to assign the required role at the subscription scope. Admin consent alone does not automatically grant subscription-level cost access. ## Service Principal With the Service Principal flow, you create or use an app registration and assign it the required read-only role. The Service Principal should be scoped only to the subscriptions Cloud Halo needs to monitor. Rotate Service Principal secrets according to your organisation policy. If the secret expires or is deleted, Cloud Halo syncs will fail until the connection is updated. ## Permission scope Use the narrowest scope that matches what you want Cloud Halo to monitor. Common scopes are: * Subscription scope, for one Azure subscription * Management group scope, for multiple subscriptions under one management group * Billing scope, when your billing model requires billing-reader access ## Features that depend on metadata Some Cloud Halo features work best when resource metadata and tags are available: * Tag-based spend breakdown * Cost allocation rules * Resource-level drilldowns * Recommendation savings tracking If these views show incomplete data, confirm that the Azure identity has the read-only access needed to read resource metadata as well as cost data. ## Security guidance Use these practices when granting access: * Grant read-only roles only * Avoid Owner, Contributor, or User Access Administrator roles * Review role assignments regularly * Rotate Service Principal secrets according to your organisation policy * Remove role assignments before disconnecting Cloud Halo if you no longer want access --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cloud-halo.io/azure-setup/permissions-required.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.