Skip to main content

Assign Azure RBAC roles

Add the Azure FinOps and GreenOps modules by assigning built-in, read-only Azure roles to the Zation Platform Connector App Registration. If you don't plan to use the Azure module, skip this page.

The Platform reads cost, metric, and resource data at the Management Group scope, so a single set of role assignments covers every Azure subscription in your tenant.

Before you begin​

  • Complete the Onboarding guide through Step 2, so the App Registration exists.
  • Owner or User Access Administrator on the Tenant Root Group (Management Group).
  • A Global Administrator has no Azure role on the Tenant Root Group by default. In the Microsoft Entra admin center, set Access management for Azure resources to Yes under Properties. Otherwise + Add role assignment is missing on the root.
  • For the two tenant-scope roles (Reservations Reader and Savings plan reader): the Global Administrator role and Access management for Azure resources set to Yes under Microsoft Entra ID → Properties. You can revert the toggle after the assignments are done.

Step 1: Assign roles on the Tenant Root Group​

  1. In the Azure Portal, open Management Groups → Tenant Root Group → Access control (IAM) → + Add role assignment.

  2. Assign these built-in roles to the Zation Platform Connector service principal:

    RolePurpose
    ReaderResource inventory, tags, diagnostic settings, utilization metrics, Log Analytics workspaces, and backup vaults, all through its */read action
    Cost Management ReaderCost and usage data. Required for Enterprise Agreement billing scopes, where Reader is not sufficient
    Carbon Optimization ReaderMicrosoft-measured CO₂e emissions per subscription and resource for Azure GreenOps

About Carbon Optimization Reader​

Carbon Optimization Reader unlocks Microsoft-measured emissions on Azure GreenOps. Without it, Azure GreenOps shows Zation's proxy estimates instead of measured data. The role is required for the Azure module. Assign it at the Management Group scope so every subscription inherits it. New Azure data appears from the 19th day of the following month.

Grace period for existing customers

Existing customers get a grace period after the requirement is introduced. During it, the Platform lists the role as recommended, not required. The permission reminder e-mail states the exact date from which the role is required. The PowerShell setup script assigns the role for new connections right away.

Enable Prod-AzureSustainability in your tenant

Microsoft's Carbon service also needs the Enterprise App Prod-AzureSustainability enabled in your tenant. Check under Microsoft Entra ID → Enterprise applications. If a tenant admin disabled it, the role alone isn't enough.

Step 2: Assign Reservations Reader and Savings plan reader​

These two roles are not inherited from the Management Group, because Reservations and Savings Plans are tenant-level resources. Assign each one once at tenant scope. A single assignment covers every current and future commitment, so you don't have to revisit it when you buy new Reservations or Savings Plans.

  • Reservations Reader: Reservations → Role assignment (top toolbar). Scope: /providers/Microsoft.Capacity.
  • Savings plan reader: Savings plans → Role assignment (top toolbar). Scope: /providers/Microsoft.BillingBenefits.

Alternative: PowerShell auto-setup​

The Setup guide and Onboarding Wizard in the Platform offer a download for zation-rbac-setup.ps1. One run assigns the three Management Group roles (Reader, Cost Management Reader, and Carbon Optimization Reader) and the two tenant-scope roles (Reservations Reader and Savings plan reader).

The script prompts for the Tenant Root Group name and uses the Client ID from your App Registration. RBAC propagation can take up to 30 minutes.

Next steps​