Connect to Azure

Azure Integration Overview

Integrate Azure with Finout to generate comprehensive cost and usage reports tailored to your organization's needs. Configure Finout to create detailed reports using Azure data, either for specific subscriptions or across your entire organization. This integration allows for in-depth analysis and management of expenses, offering valuable insights into cost allocation and usage trends across your Azure infrastructure.

Azure Configuration Workflow:

1. Create a Service Principal for Finout

2. Create the Billing Export

3. Grant Finout Read-Only Permission from the Export Storage

4. Integrate Azure with Finout

1. Create a Service Principal for Finout

The integration to your Azure is achieved by using an Azure service principal. There are two options: a. Create a service principle using the CLI.

b. Create a service principal using the Azure portal and set up an authentication.

a. Create a service principal using the CLI

From the CLI, type the following:

az ad sp create-for-rbac -n "finout"

You will receive an output similar to the following:

{
  "appId": "3c666g0g6-8cb8-8b33-cba6-abc7676a8989",
  "displayName": "finout",
  "password": "789************************",
  "tenant": "6666b777-ba88-44a9-a4aa-666ccb222a91"
}

Important: Save the following details to use in the Finout console (step 4):

• appId → Application (client) ID

• tenant → Directory (tenant) ID

• password → Application password (Client Secret

b. Create a service principal using the Azure portal

1. From your Azure portal, search for and select Azure Active Directory.

2. Select App registrations, then click New registration.

3. Name the application (For example, "Finout").

4. Leave the default values in the rest of the parameters and click Register.

5. The Overview page provides two of the credentials required for the Finout console (step 4) the Application (client) ID and the Directory (tenant) ID.

Important: Save the following details to use in the Finout console (step 4):

• appId → Application (client) ID

• tenant → Directory (tenant) ID

Set up the authentication

For the Finout integration, use the password-based authentication (application secret) method by following these steps: ​

1. Select Certificates & secrets from the left-hand menu on the app registration page. ​

   
2. Click + New client secrets to create a new client secret.

3. Select a time frame for its expiration, add a description, and then click Add.

Note: If the secret is set to expire, you must remember to renew the credentials and reconfigure it in the Finout console.

1. Copy the Value from the Client secret to the Application secret field in the Finout console (step 4).

2. Create the Billing Export

In this step, create the export for the billing scope and grant Finout read-only access to these export files.

Important: Ensure you're on the billing scope when performing the following step. To ensure you're on the billing scope, check the text on your cost management screen that states Billing account.

Create the report exports on the billing scope:

The reports must be exported twice, once for each of the following cost types:

1. Actual cost

2. Amortized cost

You should provide a different directory for both exports, but both exports must be exported to the same container.

To create an export in your Azure portal:

1. In Azure, navigate to Cost Management.

   
2. Click Exports in the left-hand menu.

   
3. From the Export screen, click + Create. The New export page appears.

   
4. Click Cost and Usage (actual or amortized).

​Note: The reports must be exported twice, once for each cost type. You should provide a different directory for both exports, but both exports must be exported to the same container.

You are brought to the Datasets tab.

1. Add the Export Profile name and click Next. You are brought to the Destination tab.

   Important: - Ensure that the Format is CSV. - Ensure that the Compression type is None.

Fill in the details required on the destination page.

Note: Save the following details to add to Finout (step 4): -Storage Account

-Container

-Actual Cost Directory and Export Name

-Amortized Cost Directory and Export Name

1. Click Next. You are brought to the Review and Create tab.

2. Review the summary and click Create.

3. After the export is created, select it from the export page and click Run now.

3. Grant Finout Read-Only Permission from the Export Storage

Grant read-only permission by using Azure CLI or the Azure portal.

Grant permissions using Azure CLI

• Type the following command in your CLI and fill in the parameters according to the role and storage details:

  az role assignment create --assignee <app_id> --role "Storage Blob Data Reader" --scope /subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/Microsoft.Storage/storageAccounts/<storage_account_name>/blobServices/default/containers/<container_name>

Grant permissions using the Azure portal

1. From your Storage account page, click Containers and select the export container.

2. Select Access control (IAM).

3. Click +Add and then click Add role assignment.

4. Search for Storage blob data reader, select it, and then click Next.

5. Click + Select members and find the Finout service principal.

6. Select the Finout service principal and click Select.

7. Click Review + Assign.

4. Integrate Azure with Finout

1. Navigate to Settings > Cost Centers and click Add cost center. The Connect Accounts window appears.

   
2. In Azure, click Connect Now. The Azure integration window appears.

   
3. Add the details saved from step 1 and click Next. You are brought to the Create the billing export page.

   
4. Add the details saved from step 2 and click Next. The integration is complete.

Important: To successfully finish the Azure integration with Finout, ensure the export files exist in the given container.