Connecting Azure Cost Management
Factor Fifty imports customer-visible Azure costs from a customer-owned Azure Cost Management export. For CSP customer subscriptions, these are the retail costs the customer can see in Azure. CSP discounts, partner-earned credit, and partner invoice pricing are not included.
You can either create a dedicated export or reuse an existing compatible export. In both cases, Azure remains the source of record and Factor Fifty receives read-only access to the selected Blob container.
Before you begin
You need:
- A connected Azure subscription and an active Reader credential
- Permission to inspect or create Cost Management exports at the billing scope
- Permission to create Azure role assignments on the export container
- PowerShell 7.2 or later with the
Az.Accounts,Az.Resources, andAz.Storagemodules - Customer cost visibility enabled by the CSP for a CSP customer subscription
For CSP customers, use the customer subscription resource ID as the billing scope:
/subscriptions/00000000-0000-0000-0000-000000000000
Reader permissions
Azure resource roles and Blob data roles are separate. The subscription Reader role lets an application inspect Azure resources, but does not let it read the contents of a Blob container.
Factor Fifty grants the selected application the following additional role:
| Role | Scope | Purpose |
|---|---|---|
| Storage Blob Data Reader | The exact export container | List manifests and read exported Parquet files |
The role is not assigned at subscription, resource group, or storage-account scope. Factor Fifty records the application, principal, role assignment, and container scope with the billing connection so access can be reviewed and removed later.
Select the existing Read-only credential when possible. An Admin credential can technically be selected, but the Blob permission added to it is still read-only and container-scoped. The Admin credential's broader resource permissions are not required for routine cost imports.
Option 1: Create a dedicated export
This is the recommended option for a new connection.
- Open the customer in Factor Fifty.
- Open Billing Connections and select Microsoft Azure.
- Enter a display name, agreement type, and billing scope.
- Under Export source, select Create a dedicated export.
- Select the dedicated Factor Fifty application or an existing Read-only credential.
- Enter the subscription and region where the customer-owned storage should be created.
- Select Generate PowerShell.
- Run the script while signed in with an Azure account that can create storage, exports, and role assignments.
- Wait for the script to finish and copy its final JSON line.
- Paste the JSON receipt into Factor Fifty and select Verify & connect.
The script creates:
- A private StorageV2 account and dedicated Blob container
- An active daily month-to-date FOCUS export
- One calendar-month export for each requested historical month
- A Storage Blob Data Reader assignment on only that container
The export uses FOCUS 1.2-preview, Parquet, Snappy compression, partitioning, and overwrite mode.
Option 2: Reuse an existing export
Use this option when the customer already runs a compatible Azure Cost Management export.
- In Azure Cost Management, open the existing export and note its billing scope and export name.
- In the Storage account, note the complete resource ID, container, and export directory.
- In Factor Fifty, choose Reuse an existing FOCUS export.
- Enter the existing export details exactly as configured in Azure.
- Select the application Factor Fifty should use to read the container.
- Generate and run the PowerShell script.
- Paste the final JSON receipt into Factor Fifty and select Verify & connect.
The adoption script does not modify the export. It verifies its configuration and creates only the container-scoped reader assignment if it is missing.
Compatibility requirements
An existing export must use all of the following settings:
| Setting | Required value |
|---|---|
| Data type | Cost and usage details (FOCUS) |
| Dataset version | 1.2-preview |
| Format | Parquet |
| Compression | Snappy |
| Partitioning | Enabled |
| Frequency | Active, daily |
| Timeframe | Month to date |
| Overwrite | Overwrite previous report |
The container must contain an Azure-generated manifest and the manifest must reference readable Parquet parts beneath the configured export directory. A Parquet extension alone is not sufficient. Portal downloads, custom Parquet files, CSV exports, and manifests from another billing scope are rejected.
An existing Storage account can be reused. Prefer a dedicated cost-export container. If a container also holds unrelated data, create a separate container in the same account so the reader assignment does not expose those unrelated blobs.
Storage networking
The selected application needs both Azure RBAC permission and network access to the Blob endpoint. If the Storage firewall is enabled, allow the Factor Fifty collector's configured outbound path. A role assignment cannot bypass a Storage firewall or private endpoint.
The Azure Cost Management export identity also needs permission to write into the container. That writer permission is owned by the Azure export and is separate from Factor Fifty's reader permission.
Verification and data freshness
Before saving the connection, Factor Fifty verifies that it can:
- Authenticate as the selected application
- List the exact export directory
- Read an Azure FOCUS manifest
- Match the manifest to the configured billing scope, export name, and dataset version
- Read the Parquet signature of a referenced data file
Azure daily exports contain month-to-date data. Azure can update the previous month during the first days of a new month, and Factor Fifty processes the replacement as a newer execution.
Disconnecting
For a Factor Fifty-created export, the disconnect instructions identify the exports and reader assignment that should be removed in Azure.
For a reused customer export, Factor Fifty never instructs you to delete or change the export. Remove only the recorded Storage Blob Data Reader assignment if Factor Fifty should no longer read the container.
Troubleshooting
Factor Fifty cannot read the container
Confirm that Storage Blob Data Reader is assigned to the selected application's enterprise application at the exact container scope. Azure RBAC changes can take several minutes to propagate.
The existing export is incompatible
Compare every setting in the compatibility table. Create a dedicated Factor Fifty export if changing the customer export would affect another process.
Authentication works but Blob access fails
Check the Storage firewall, public network access, private endpoints, and the selected application's role assignment. Subscription Reader or Contributor access does not grant Blob data access.
The first manifest is not available
Run the export in Azure and wait for it to complete. New Cost Management exports can take up to 24 hours to produce their first file.
For Azure's export behavior and supported settings, see Create and manage Cost Management exports. For the distinction between resource and Blob data permissions, see Assign an Azure role for Blob data access.