Connect Azure to CostWatch

CostWatch pulls daily costs straight from the Azure Cost Management API using a read-only app registration you create in your own tenant. No Microsoft Graph permissions, no admin consent, no write access of any kind: one built-in role scoped to one subscription. About 5 minutes in the portal, or one CLI command.

Which role? Recommended: Reader, which unlocks everything including the stale-resource, Advisor and Container Apps utilization checks (it reads resource metadata; still zero write access). Cost Management Reader also works if you prefer the narrowest possible grant; cost trends and anomaly alerts run fully, but the savings checks that need to see resources stay locked until Reader is granted.

The CLI shortcut (one command)

If you have the Azure CLI, this creates the app registration, the secret, and the role assignment in one go. Copy the four values it prints.

az ad sp create-for-rbac --name CostWatch-Reader --role Reader --scopes /subscriptions/<subscription-id>

Prefer the narrowest grant? Swap --role Reader for --role "Cost Management Reader" (savings checks stay locked).

The command prints four values. Here is where each one goes:

appIdApplication (client) ID
passwordClient secret value
tenantDirectory (tenant) ID
displayNamenot needed

The Subscription ID is not in the output; it is the id you put in --scopes. Get it with az account show --query id -o tsv.

Or in the portal

  1. Create the app: Azure Portal > Microsoft Entra ID > App registrations > New registration. Name it CostWatch-Reader, leave everything else default, Register.
  2. Copy two IDs from the app's Overview page: Application (client) ID and Directory (tenant) ID.
  3. Create a secret: in the app, Certificates & secrets > New client secret. Copy the secret VALUE now; it is only shown once.
  4. Grant read access: Subscriptions > your subscription > Access control (IAM) > Add > Add role assignment > role Reader (or Cost Management Reader for the narrowest grant) > Members > select the CostWatch-Reader app > Review + assign.
  5. Copy the Subscription ID from the subscription's Overview page.

Then paste the four values into CostWatch

Open your subscription in CostWatch and fill in the Connect Azure form: tenant ID, client ID, client secret, subscription ID. CostWatch tests the connection before saving anything, pulls 90 days of history on the spot, and then syncs nightly on its own.

Start your 7-day trial

What CostWatch can and cannot do with this

  • Can: read cost and usage aggregates for the one subscription you scoped. With Reader, also resource metadata (names, sizes, states) and metrics for the savings and utilization checks.
  • Cannot: see data inside resources, keys, or users; cannot change anything.
  • The client secret is stored encrypted and never shown again in the UI.
  • Disconnect any time; cost data already pulled stays in your account.