Skip to main content

​
Overview

The Microsoft Azure FinOps integration connects Azure subscriptions to G360. Once configured, G360 securely connects to your Azure environment and collects cloud infrastructure, cost, and operational metrics for analysis and reporting. Using this integration, administrators can:
  • Connect Azure subscriptions using a Microsoft Entra ID App Registration (service principal)
  • Ingest Azure Cost Management export data from a Blob storage container
  • Collect general resource and infrastructure metrics
  • Turn collection on or off per connection

​
Prerequisites

Before you start, ensure that:
  • You have a Microsoft Azure account and can sign in to the Azure Portal.
  • You can create or view App Registrations in Microsoft Entra ID (Azure Active Directory).
  • You can assign roles at the Subscription level (Owner or User Access Administrator).
  • The App Registration (service principal) has the permissions G360 needs to collect Azure metrics. The steps below set these up.
If your organization manages Azure centrally, contact your Azure administrator to obtain these credentials or to be granted the required permissions.

​
Open Azure FinOps Connections

1

Log in to G360

Sign in to G360.
2

Open Microsoft Azure Connections

In the left navigation panel, expand Cloud Provider Metrics and select Microsoft Azure Connections.
The page lists every configured Azure integration: Use the search bar at the top of the page to find a connection by name.

​
Prepare Azure credentials

Get these values from the Azure Portal before you create the connection in G360. G360 authenticates as a Microsoft Entra ID App Registration (also called a service principal). If your organization already has an App Registration for G360, reuse it.
1

Sign in to the Azure Portal

Open the Azure Portal and sign in with your Azure account.
2

Create or locate an App Registration

If you don’t have one yet:
  1. Search for Microsoft Entra ID and open the service.
  2. In the left navigation panel, select App registrations.
  3. Click New registration.
  4. Enter a name, for example G360MonitoringApp.
  5. Under Supported account types, select Accounts in this organizational directory only (Single tenant).
  6. Click Register.
3

Copy the Tenant ID and Client ID

Open the App Registration. On the Overview page, copy both values:
  • Directory (tenant) ID for the G360 Tenant ID field
  • Application (client) ID for the G360 Client ID field
4

Copy the Subscription ID

Search for Subscriptions and select the subscription you want G360 to monitor. On its Overview page, copy the Subscription ID. It identifies the subscription that contains the resources G360 monitors, and goes in the G360 Subscription ID field.
5

Generate a Client Secret

G360 authenticates with a Client Secret on the App Registration.
  1. Open the App Registration and select Certificates & secrets in the left navigation panel.
  2. Under Client secrets, click New client secret.
  3. Enter a description and select an expiry period.
  4. Click Add.
  5. Copy the secret Value.
Azure displays the Client Secret value only once. Store it securely before you leave the page. If you lose it, generate a new Client Secret.
6

Assign roles on the subscription

Grant the App Registration access to the subscription. Repeat these steps once for each role: Cost Management Reader and Reader.
  1. Open the subscription and select Access control (IAM) in the left navigation panel.
  2. Click Add → Add role assignment.
  3. Under Role, select the role.
  4. Under Members, click Select members and search for the App Registration (for example, G360MonitoringApp).
  5. Click Review + assign.
Cost Management Reader provides cost data. Reader lets G360 collect general resource and infrastructure metrics.
Cost Management Reader and Reader are the minimum roles G360 requires. Don’t assign Owner or Contributor unless your organization requires it for other purposes.

​
Set up cost export

The Storage Account URL is required for G360’s cost metrics pipeline. Without it, G360 cannot ingest Azure Cost Management export data and cost metrics do not populate for the connection. Complete this section before you create the connection. The Export Container field is optional and defaults to focus-exports.
1

Create or locate a Storage Account

Search for Storage accounts in the Azure Portal. Select an existing storage account, or click Create to make a new one, then open it.
2

Create a Blob container

  1. In the storage account, select Containers.
  2. Click + Container.
  3. Enter a name, for example cost-exports, and click Create.
This is the name you enter in the G360 Export Container field.
3

Copy the Storage Account URL

On the storage account’s Overview or Endpoints page, find the Primary endpoint under Blob service. Append your container name to form the full URL:
This is the value for the G360 Storage Account URL field.
4

Grant the App Registration access to the Storage Account

  1. Open the storage account and select Access control (IAM).
  2. Click Add → Add role assignment.
  3. Under Role, select Storage Blob Data Reader.
  4. Under Members, select the App Registration you created earlier.
  5. Click Review + assign.
5

Create a Cost Management export

  1. Search for Cost Management in the Azure Portal.
  2. Select the subscription, then select Exports in the left navigation panel.
  3. Click + Add.
  4. Point the export at the storage account and container you created.
  5. Set the frequency (for example, daily) and save the export.

​
Create a connection

1

Open the connection dialog

In G360, go to Cloud Provider Metrics → Microsoft Azure Connections and click Add Connection. The Add Azure FinOps Connection dialog opens.
2

Enter connection details

3

Set the Is Active toggle

  • Enabled: once saved, the connection is included in the next scheduled sync.
  • Disabled: the connection is saved but collects no metrics until you enable it.
4

Test the connection

Confirm all required fields are filled in, then click Test Connection. G360 validates that:
  • The Tenant ID and Client ID are valid.
  • The Client Secret is valid and has not expired.
  • The Subscription ID exists and is accessible to the App Registration.
  • The App Registration has the Reader and Cost Management Reader roles on the subscription.
If validation succeeds, the connection is ready to save. If it fails, see Troubleshooting.
5

Save the connection

Click Save Connection. The new connection appears in the Azure FinOps Connections dashboard.
Test Connection checks only your sign-in details. It does not confirm that the Storage Account is reachable. You only know for sure once the first sync completes.

​
Manage connections

Find the connection in the table, click the Edit icon under Actions, update the fields, then click Test Connection and Save Connection. The updated configuration takes effect immediately.
Editing the Tenant ID, Client ID, Client Secret, Subscription ID, or Storage Account URL wipes previously collected data for this connection before it re-syncs. Editing other fields, such as Name or Organization, does not wipe data.
Find the connection in the table, click the Delete icon under Actions, and confirm. This removes the Azure integration from G360 and stops future metric collection for that subscription.
Deleting a connection immediately wipes its previously collected data, not just future collection. Deletion is blocked if the connection is linked to a Project. Remove that association first.
Active connections are enabled and G360 actively collects metrics from the configured subscription. Inactive connections stay configured but are disabled, and collect no metrics until you enable them again.

​
Synchronization and metrics

Once a connection is saved and Active, it is included in the next scheduled sync. Metric collection is not immediate. G360 collects cost data from the Cost Management exports in your storage account, and general resource and infrastructure metrics from the subscription.

​
Troubleshooting

Possible causes
  • Tenant ID, Client ID, or Subscription ID copied incorrectly
  • Client Secret copied incorrectly or expired
  • Missing role assignments on the subscription
  • App Registration deleted or disabled in Microsoft Entra ID
  • Incorrect Storage Account URL or Export Container
Actions
  • Verify the Tenant ID and Client ID were copied correctly.
  • Verify the Client Secret was copied correctly and has not expired.
  • Confirm the App Registration has the Reader and Cost Management Reader roles on the subscription.
  • Verify the Subscription ID is correct.
  • Verify the Storage Account URL and Export Container are correct, if provided.
  • Confirm the App Registration has not been deleted or disabled in Microsoft Entra ID.
Possible causes
  • Connection is not Active, or the first scheduled sync has not run yet
  • Expired Client Secret
  • Missing permissions
  • Wrong Subscription ID, or no matching resources in it
Actions
  • Confirm the connection is marked Active.
  • Confirm the configured Client Secret has not expired.
  • Confirm the App Registration has the permissions required for metric collection.
  • Confirm the correct Subscription ID is configured.
  • Confirm the Azure resources you expect to monitor exist in that subscription.
Possible causes
  • Required fields (marked *) are empty
  • Test Connection did not pass
  • Invalid credentials, or the App Registration or subscription no longer exists
Actions
  • Complete all required fields.
  • Make sure the connection passes Test Connection.
  • Confirm the Azure credentials are valid.
  • Confirm the App Registration and subscription still exist in Azure.

​
Best practices

  • Use a dedicated App Registration for G360 instead of sharing administrator credentials.
  • Grant only the Reader and Cost Management Reader roles required for metric collection. Add Storage Blob Data Reader only if you use Cost Management exports.
  • Store Client Secrets securely and rotate them before they expire.
  • Use descriptive connection names that identify the Azure environment.
  • Test every connection before saving it.
  • Disable unused connections instead of deleting them if you may need them again.
  • Review role assignments regularly so G360 keeps only the minimum required access.

​
Summary

The Microsoft Azure FinOps integration connects Azure subscriptions to G360 to collect cost, infrastructure, and operational metrics. Create an App Registration with the Reader and Cost Management Reader roles, set up a Cost Management export to a Blob container, then create, test, and save the connection.