How to Configure a Service Principal for FinOps Portal Access to Azure Cost Management and Metrics APIs. Cumulus Savings FinOps portal needs non-interactive access to Azure cost data (via the Cost Management APIs) and resource metrics (via the Azure Monitor Metrics API). The standard, secure way to provide this is with a Microsoft Entra ID service principal that has the minimum required permissions. This guide walks through creating the service principal and granting the necessary access for both Cost Management and Metrics either in Azure Portal or Azure CLI.

To onboard Azure Subscription to Cumulus Savings FinOps Portal following authentication details are required

• Subscription ID
• Tenant ID
• Client ID
• Client secret

To configure it in your environment you will need following prerequisites

• Permissions to create app registrations in Microsoft Entra ID.
• Ability to assign roles (Owner, User Access Administrator, or Enrollment Writer / equivalent billing role depending on scope).
• Your billing account type: Enterprise Agreement (EA), Microsoft Customer Agreement (MCA), or subscription/management group scope.

Create the Service Principal via Azure CLI (recommended)

Easiest and recommended way to create Service Principal is via command line

Create the Service Principal

az ad sp create-for-rbac \
  --name "cululussavings-finops-portal-sp" \
  --scopes "/subscriptions/<subscription-id>" \
  --sdk-auth

Save the output securely:

• appId → Client ID
• password → Client Secret (shown only once)
• tenant → Tenant ID

Grant Access to Cost Management APIs

az role assignment create \
  --assignee <client-id> \
  --role "Cost Management Reader" \
  --scope "/subscriptions/<subscription-id>

Grant Access to Metrics APIs

az role assignment create \
  --assignee <client-id> \
  --role "Monitoring Reader" \
  --scope "/subscriptions/<subscription-id>

Create the Service Principal via Azure Portal

1. Register the Application

• Navigate to Microsoft Entra ID → App registrations → New registration.
• Name your application (e.g., cumulus-savings-finops-portal-sp), leave the supported account types as Single tenant, and click Register.
• Note down the Application (client) ID and Directory (tenant) ID from the overview page.

2. Generate a Client Secret

• Go to Certificates & secrets → New client secret.
• Add a description and expiration, then copy the Secret Value immediately (it will not be visible again once you leave the page).

3. Locate the Service Principal Object ID

• Go to Enterprise applications, search for and select your newly registered app (finops-portal-sp).
• Note the Object ID from the Overview blade. (Note: This is the service principal object ID you will need when assigning roles at the subscription or management group scope).

Grant Access to Cost Management APIs

Grant Cost Management Reader and Monitoring Reader Roles to allow your service principal to read cost and monitoring data, you need to assign it the appropriate built-in Azure RBAC roles at the desired scope (such as a specific Subscription or Management Group).

Option A: Assign via Azure Portal (Subscription Level)

• Open the Azure Portal.
• Search for and select Subscriptions.
• Click on the subscription where you want to grant access.
• In the left-hand navigation menu, click on Access control (IAM).
• Click + Add and select Add role assignment. -Find the Roles: Search for and select Cost Management Reader, then click Next. (Repeat this process for Monitoring Reader).
• Assign Access To: Select User, group, or service principal.
• Select Members: Click + Select members, search for your service principal name (finops-portal-sp), select it from the list, and click Select. -Review and Assign: Click Review + assign to finalize the assignment.

NOTE! For Enterprise Agreement (EA) billing scopes or Management Groups, navigate to Cost Management + Billing or Management Groups respectively, go to Access control (IAM), and follow the same assignment steps above to ensure the service principal has visibility across your required hierarchy.

What if I do not have access to Entra ID

If you do not have access and Entra ID is managed by someone else, request creation of Service Principal with Cost Management Reader and Monitoring Reader permissions on subscription you would like to onboard to the portal.

Check if the service principal can query Azure API for costs.

When service principal is created you can use following script to verify authentication and access to cost data.

Test Authenticate

Use the client credentials flow:

az login --service-principal \
  -u <client-id> \
  -p <client-secret> \
  --tenant <tenant-id>

Test Cost Management query

az costmanagement query \
  --type Usage \
  --scope "/subscriptions/<subscription-id>" \
  --timeframe MonthToDate