Source boundary
Microsoft Azure
Confirm source eligibility in your workspace before creating access.
- Financial source
- Cost Details or scheduled Cost Management Exports
- Reviewed
- 2026-09-17
- Cost bases
- net, billed, amortized, list, contracted, credits, tax
- Useful dimensions
- billing scope, subscription, resource group, service, meter, resource, region, Foundry publisher, model and reported usage when supplied
Known limits
- Available fields differ by agreement and billing scope.
- Actual and amortized totals are alternatives, not additive values.
- The provider-specific Foundry section and optional monitoring remain flag-disabled pending external validation.
Prepare the connection
Eligibility
An eligible subscription or billing scope with Cost Management Reader access is required.
Create a federated credential with billing-reader access, or use an encrypted client secret when federation is unavailable.
Authentication choices
- Workload identity federation — recommendedPruneFox stores only safe federation configuration references; provider tokens are not persisted.
- Client secretPruneFox stores the credential encrypted in the isolated credential broker and never returns it to the browser.
Connection details
| Field | Why it is needed | Example format |
|---|---|---|
| Directory (tenant) ID | Microsoft Entra tenant that owns the billing scope. | 00000000-0000-0000-0000-000000000000 |
| Cost Management scope | Use one subscription or the highest exact billing scope this identity may read. | /subscriptions/00000000-0000-0000-0000-000000000000 |
| Application (client) ID | Dedicated app registration with Cost Management Reader access. | 00000000-0000-0000-0000-000000000000 |
Permission boundary
| Resource | Read or bounded staging permissions | Purpose |
|---|---|---|
| Exact billing scope | Cost Management Reader | Generate and read bounded cost details without infrastructure or billing mutation. |
Connection sequence
- Choose one subscription or billing scope.
- Create a dedicated application with Cost Management Reader only.
- Enter the tenant, application, exact scope, and secret.
- Validate tenant/scope identity and report eligibility before requesting the first bounded report.
Validation and first sync
Validation rejects a different tenant, an ambiguous or unsupported scope, write roles, missing report access, and secure download URLs outside the exact Azure host policy.
Small bounded windows use Cost Details no more than once per 24 hours; certified high-volume connections discover scheduled Exports without creating them from the normal schedule.
Freshness: Exports and reports can settle after usage; PruneFox publishes only reconciled windows and preserves the previous generation on failure.
Remove access
Revoke the connection, remove the federated credential or secret, and remove the reader assignment.
Troubleshooting
Check tenant IDs, exact scope syntax, reader assignment, agreement support, export delivery, and the 24-hour report-generation guard.
Verify the first completed period
Compare one bounded completed period with the provider billing source. Match currency and cost basis, inspect credits and adjustments, and confirm that missing dimensions remain unavailable rather than zero.
Troubleshoot safely
Use the visible connection state, provider name, affected date range, and expected outcome. Never send credentials, raw billing exports, payment data, or customer records through support.