> ## Documentation Index > Fetch the complete documentation index at: https://docs.heygarth.ai/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft azure finops ## Overview The Microsoft Azure FinOps Connections page allows administrators to integrate Microsoft Azure subscriptions with G360. Once configured, G360 can securely connect to your Azure environment and collect cloud infrastructure, cost, and operational metrics for analysis and reporting. ## Accessing Azure FinOps Connections 1. Log in to G360. 2. From the left navigation panel, expand **Cloud Provider Metrics**. 3. Select **Microsoft Azure Connections**. The Microsoft Azure FinOps Connections page displays all configured Azure integrations. ## Azure FinOps Connections Dashboard The Azure FinOps Connections dashboard provides a centralized view of all configured Azure integrations. ### Connection Name Displays the user-defined name assigned to the Azure connection. ### Organization Displays the organization linked to the Azure account. ### Is Active Indicates whether the connection is currently active and available for metric collection. ### Last Updated Displays the date and time when the connection was last modified. ### Actions Provides options to edit or delete the connection. ### Search Connections Use the search bar at the top of the page to quickly locate a specific Azure connection by name. # Prepare Azure Credentials Before creating an Azure connection in G360, you must first obtain the required Azure credentials from the Azure Portal. If your organization manages Azure centrally, you may need to contact your Azure administrator to obtain these credentials or to grant you the required permissions. ## Prerequisites Before proceeding, ensure that: * You have a Microsoft Azure account. * You can sign in to the Azure Portal. * You have permission to create or view App Registrations in Microsoft Entra ID (Azure Active Directory). * You have permission to assign roles at the Subscription level (Owner or User Access Administrator). * The App Registration (service principal) has the permissions required by G360 to collect Azure metrics. ## Sign in to Azure 1. Open the Azure Portal. 2. Sign in using your Azure account. 3. After signing in, you will be redirected to the Azure Portal home page. ## Create or Locate an App Registration G360 accesses your Azure environment by authenticating as a Microsoft Entra ID (Azure Active Directory) App Registration, also known as a service principal. If your organization has already created an App Registration for G360, you can use that App Registration. Otherwise: 1. In the Azure Portal, search for: ``` Microsoft Entra ID ``` 1. Open the **Microsoft Entra ID** service. 2. From the left navigation panel, select: ``` App registrations ``` 1. Click **New registration**. 2. Enter a name, for example: ``` G360MonitoringApp ``` 1. Under **Supported account types**, select **Accounts in this organizational directory only (Single tenant)**. 2. Click **Register**. ## Copy the Tenant ID and Client ID Open the App Registration you created or located. On the **Overview** page, locate the following fields: * Directory (tenant) ID * Application (client) ID Copy both values. You will enter these into the **Tenant ID** and **Client ID** fields when creating the Azure connection in G360. ## Determine the Subscription ID The Subscription ID identifies the Azure subscription that contains the resources you want G360 to monitor. 1. In the Azure Portal, search for: ``` Subscriptions ``` 1. Select the subscription you want G360 to monitor. 2. On the **Overview** page, locate the field labeled **Subscription ID**. Copy this value. You will enter it into the **Subscription ID** field when creating the Azure connection in G360. ## Generate a Client Secret G360 authenticates with Azure using a Client Secret associated with the App Registration. To generate this credential: 1. Open the App Registration. 2. From the left navigation panel, select: ``` Certificates & secrets ``` 1. Under **Client secrets**, click **New client secret**. 2. Enter a description and select an expiry period. 3. Click **Add**. Azure generates a **Value** for the client secret. Copy this value immediately. > Warning: > > Azure displays the Client Secret value only once. > > Store it securely before leaving the page. If it is lost, a new Client Secret must be generated. ## Assign Required Permissions The App Registration must be granted access to the subscription before G360 can collect metrics. To assign the required roles: 1. Open the subscription noted earlier. 2. From the left navigation panel, select: ``` Access control (IAM) ``` 1. Click **Add → Add role assignment**. 2. Under **Role**, select: ``` Cost Management Reader ``` 1. Under **Members**, click **Select members** and search for the App Registration created earlier (for example, `G360MonitoringApp`). 2. Click **Review + assign**. 3. Repeat the steps above to also assign the **Reader** role, which allows G360 to collect general resource and infrastructure metrics in addition to cost data. > Note: > > Cost Management Reader and Reader are the minimum scopes required by G360. > > Do not assign Owner or Contributor unless your organization requires it for other purposes. ## Set Up Cost Export The **Storage Account URL** is required for G360's cost metrics pipeline to function — without it, G360 has no way to ingest Azure Cost Management export data, and cost metrics will not populate for this connection. Complete this section before creating the connection. The **Export Container** field is optional: if left blank, G360 defaults to a container named `focus-exports`. ### Create or Locate a Storage Account 1. In the Azure Portal, search for: ``` Storage accounts ``` 1. Select an existing storage account or click **Create** to create a new one. 2. Once created, open the storage account. ### Create a Blob Container 1. Within the storage account, select: ``` Containers ``` 1. Click **+ Container**. 2. Enter a name, for example: ``` cost-exports ``` 1. Click **Create**. This container name is what you will enter into the **Export Container** field in G360. ### Copy the Storage Account URL On the storage account's **Overview** or **Endpoints** page, locate the **Primary endpoint** listed under **Blob service**. Combine this with your container name to form the full URL, in the format: ``` https://.blob.core.windows.net/ ``` You will enter this into the **Storage Account URL** field when creating the Azure connection in G360. ### Grant the App Registration Access to the Storage Account 1. Open the storage account. 2. From the left navigation panel, select: ``` Access control (IAM) ``` 1. Click **Add → Add role assignment**. 2. Under **Role**, select: ``` Storage Blob Data Reader ``` 1. Under **Members**, select the App Registration created earlier. 2. Click **Review + assign**. ### Create a Cost Management Export 1. In the Azure Portal, search for: ``` Cost Management ``` 1. Select the subscription, then select **Exports** from the left navigation panel. 2. Click **+ Add**. 3. Configure the export to point to the storage account and container created above. 4. Set the desired frequency (for example, daily) and save the export. ## Creating a New Azure Connection After obtaining the required Azure credentials: 1. Return to **G360**. 2. Navigate to **Cloud Provider Metrics → Microsoft Azure Connections**. 3. Click **Add Connection**. The **Add Azure FinOps Connection** dialog appears. ## Connection Fields ### Name (Required) Enter a unique and descriptive name to identify the Azure connection within G360. Example: ``` Production Azure Account ``` ### Tenant ID (Required) Paste the Directory (tenant) ID copied from the App Registration Overview page. Example: ``` xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ``` ### Client ID (Required) Paste the Application (client) ID copied from the App Registration Overview page. Example: ``` xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ``` ### Client Secret (Required) Paste the Client Secret Value generated under Certificates & secrets. For security purposes, this value is masked after it is entered. > Warning: > > Azure displays the Client Secret value only once when it is created. > > If you no longer have the Client Secret, generate a new one in the Azure Portal. ### Subscription ID (Required) Enter the Subscription ID of the Azure subscription where the monitored resources are located. The Subscription ID can be found on the Overview page of the subscription in the Azure Portal. Example: ``` xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ``` ### Organization (Optional) Enter the organization, department, or business unit associated with this Azure account. This field is used only for organizing Azure connections within G360. Example: ``` Finance Team ``` ### Export Container (Required) Enter the name of the Blob container configured to receive Cost Management exports. If left blank, G360 defaults to a container named `focus-exports`. Example: ``` cost-exports ``` ### Storage Account URL (Required) Enter the full Blob service URL of the storage account and container configured for Cost Management exports. Example: ``` https://.blob.core.windows.net/ ``` Test Connection only checks your sign-in details — it doesn't confirm the Storage Account is reachable. You'll only know for sure once the first sync completes. ### Is Active Use the toggle switch to enable or disable the connection. * **Enabled** – Once saved and active, this connection is included in the next scheduled sync. * **Disabled** – The connection is saved but no metrics are collected until the connection is enabled. ## Testing the Connection Before saving the configuration: 1. Verify that all required fields have been completed. 2. Click: ``` Test Connection ``` G360 validates the connection by verifying that: * The Tenant ID and Client ID are valid. * The Client Secret is valid and has not expired. * The Subscription ID exists and is accessible to the App Registration. * The App Registration has the Reader and Cost Management Reader roles assigned on the subscription. * The Storage Account URL and Export Container are reachable and accessible, if provided. ## Expected Result If the validation is successful: * The connection test succeeds. * G360 confirms that it can securely communicate with your Azure subscription. * The connection is ready to be saved. If the validation fails: * Verify that all credentials were copied correctly. * Confirm that the App Registration exists and the Client Secret has not expired. * Verify that the App Registration has the required role assignments on the subscription. * Ensure that the Subscription ID is correct. * Confirm that the Storage Account URL and Export Container are correct, if provided. ## Saving the Connection After the connection has been successfully validated: 1. Click: ``` Save Connection ``` The new Azure connection is added to the Azure FinOps Connections dashboard. If the **Active** toggle is enabled, this connection will be included in the next scheduled sync — metric collection isn't immediate. ## Editing an Existing Connection To modify an existing Azure connection: 1. Locate the connection in the Azure FinOps Connections table. 2. Click the **Edit** icon under the **Actions** column. 3. Update the required fields. 4. Click **Test Connection** to validate the updated configuration. 5. Click **Save Connection**. The updated configuration takes effect immediately after the connection is saved. Editing the Tenant ID, Client ID, Client Secret, Subscription ID, or Storage Account URL wipes previously collected data for this connection before it re-syncs. Editing other fields, such as Name or Organization, does not trigger a data wipe. ## Deleting a Connection To remove an Azure connection: 1. Locate the connection in the Azure FinOps Connections table. 2. Click the **Delete** icon under the **Actions** column. 3. Confirm the deletion. Deleting a connection removes the Azure integration from G360 and stops future metric collection for that Azure subscription. Deleting a connection wipes its previously collected data immediately — this is not limited to stopping future collection. Deletion is blocked if the connection is linked to a Project; remove that association before deleting. ## Connection Status The **Is Active** column indicates whether an Azure connection is currently being used for metric collection. ### Active The Azure connection is enabled and G360 actively collects metrics from the configured Azure subscription. ### Inactive The Azure connection remains configured but is disabled. No metrics are collected until the connection is enabled again. ## Best Practices To ensure secure and reliable Azure integrations: * Use a dedicated App Registration for G360 instead of sharing administrator credentials. * Grant only the Reader and Cost Management Reader roles required for metric collection (add Storage Blob Data Reader only if using Cost Management exports). * Store Client Secrets securely and rotate them before their expiry date. * Use descriptive connection names that clearly identify the Azure environment. * Test every connection before saving it. * Disable unused connections instead of deleting them if they may be needed again. * Regularly review role assignments to ensure G360 has only the minimum required access. ## Troubleshooting ### Connection Test Failed Verify the following: * The Tenant ID was copied correctly. * The Client ID was copied correctly. * The Client Secret was copied correctly and has not expired. * The App Registration has the Reader and Cost Management Reader roles assigned on the subscription. * The Subscription ID is correct. * The Storage Account URL and Export Container are correct, if provided. * The App Registration has not been deleted or disabled in Microsoft Entra ID. ### Metrics Are Not Appearing Verify the following: * The connection is marked as **Active**. * The configured Client Secret has not expired. * The App Registration has the permissions required for metric collection. * The correct Subscription ID has been configured. * The Azure resources you expect to monitor exist in the configured subscription. ### Unable to Save Connection Verify that: * All required fields marked with an asterisk (\*) have been completed. * The connection successfully passed the **Test Connection** validation. * The provided Azure credentials are valid. * The App Registration and subscription still exist in Azure.