Azure Accounts

CostLens reads your Azure cost data and resource configuration through a dedicated App Registration (service principal) granted the read-only Cost Management Reader role. Setup takes about 5 minutes, requires no agents, and never modifies your resources during scanning.

How it works#

What you'll paste into CostLens#

CostLens stores only non-secret identifiers plus one encrypted secret bundle:

Step-by-step — Azure CLI (recommended)#

The Add Account → Azure dialog generates this script with your IDs pre-filled and offers a one-click copy/download. Run it in Azure Cloud Shell or any terminal with the az CLI signed in as a user who can create app registrations and assign roles.

#!/usr/bin/env bash
# CostLens — Azure connection setup (Cost Management Reader, least privilege)
set -euo pipefail
 
SUBSCRIPTION_ID="<SUBSCRIPTION_ID>"
APP_NAME="costlens-cost-reader"
 
az account set --subscription "$SUBSCRIPTION_ID"
 
# 1. Create an app registration + service principal
APP_ID=$(az ad app create --display-name "$APP_NAME" --query appId -o tsv)
az ad sp create --id "$APP_ID" >/dev/null
 
# 2. Create a client secret (valid 12 months) — copy the printed value
CLIENT_SECRET=$(az ad app credential reset --id "$APP_ID" --years 1 --query password -o tsv)
 
# 3. Grant Cost Management Reader (read-only cost data) at the subscription scope
az role assignment create \
  --assignee "$APP_ID" \
  --role "Cost Management Reader" \
  --scope "/subscriptions/$SUBSCRIPTION_ID"
 
TENANT_ID=$(az account show --query tenantId -o tsv)
 
echo ""
echo "Paste these into CostLens:"
echo "  Tenant ID:       $TENANT_ID"
echo "  Client ID:       $APP_ID"
echo "  Client secret:   $CLIENT_SECRET"
echo "  Subscription ID: $SUBSCRIPTION_ID"

Paste the four printed values into the CostLens connect dialog and click Save. CostLens validates the credentials and starts the first sync.

Recommendations & Advisor#

Azure recommendations come from two places, both read-only:

• Azure Advisor cost recommendations (right-sizing, shutdown, reservations) — the authoritative source, surfaced by the Azure Advisor (Cost) check.
• CostLens resource checks over the Azure Resource Manager + Monitor APIs — idle VMs, unattached disks, orphaned snapshots, idle public IPs and load balancers.

Reading Advisor, resource metadata, and Monitor metrics uses the Reader and Cost Management Reader roles. If you assigned only Cost Management Reader above, also add Reader at the same scope so the resource checks can enumerate resources:

az role assignment create --assignee "$APP_ID" \
  --role "Reader" --scope "/subscriptions/$SUBSCRIPTION_ID"

Kubernetes (AKS) cost & optimization#

The Cost Management Reader + Reader roles above already give CostLens what it needs for AKS. Reader covers Azure Monitor metric reads and VM Scale Set enumeration, so no separate Monitoring Reader role is required.

Applying fixes (optional)#

Scanning is fully read-only. Applying a fix (deallocating an idle VM, deleting an unattached disk/snapshot, releasing a public IP, removing an idle load balancer) requires write access. Grant a Contributor role — or a custom role limited to the specific write actions — at the scope you want CostLens to remediate. Without a write role, recommendations are shown but the Apply Fix button stays disabled. See Auto-Fix for the approval workflow.

Enabling automatic Auto-Fix (least privilege)#

Automatic Auto-Fix (hands-off apply) on Azure covers exactly one reversible action today — stopping an idle VM (deallocate). To enable it with least privilege, grant only VM power control via a custom role rather than broad Contributor:

az role definition create --role-definition '{
  "Name": "CostLens Auto-Fix (VM power)",
  "Description": "Least-privilege VM start/deallocate for CostLens Auto-Fix",
  "Actions": [
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/deallocate/action"
  ],
  "AssignableScopes": ["/subscriptions/<SUBSCRIPTION_ID>"]
}'
az role assignment create --assignee "<CLIENT_ID>" \
  --role "CostLens Auto-Fix (VM power)" --scope "/subscriptions/<SUBSCRIPTION_ID>"

First sync phases#

Common errors and fixes#