Skip to content
Infralign Infralign Infralign docs

Getting started

How your data flows

Where your cost data goes each night, from two scoped Azure roles to the warehouse, and why nothing writes back.

Infralign reads your estate once a night through a service principal with two scoped roles. It shapes the raw data through a warehouse and surfaces dashboards, reports, a chatbot, and findings. Figure 1 shows that path; the table names each band.

Three stacked bands. The top band is your Azure tenant: development, staging, production and hub subscriptions, plus five read-only sources named Cost Details API, Resource Graph, Advisor, Monitor metrics and Activity Log, reached with the Cost Management Reader and Reader roles. One scoped service principal carries that data down into the middle band, which is Infralign: a nightly run from 02:30 to 06:15 UTC, a bronze parquet layer, a gold warehouse, and four green outputs labelled dashboards, reports, chatbot and findings. Nothing is written back to your estate. An optional FOCUS export container in your own storage joins bronze on a dashed lane, skipping the daily call. The bottom band is your team, where you approve or reject each finding and no change is prepared without it. Three stacked bands. The top band is your Azure tenant: development, staging, production and hub subscriptions, plus five read-only sources named Cost Details API, Resource Graph, Advisor, Monitor metrics and Activity Log, reached with the Cost Management Reader and Reader roles. One scoped service principal carries that data down into the middle band, which is Infralign: a nightly run from 02:30 to 06:15 UTC, a bronze parquet layer, a gold warehouse, and four green outputs labelled dashboards, reports, chatbot and findings. Nothing is written back to your estate. An optional FOCUS export container in your own storage joins bronze on a dashed lane, skipping the daily call. The bottom band is your team, where you approve or reject each finding and no change is prepared without it.
Figure 1: The nightly run only reads. Nothing in the flow writes back to your tenant, and the one decision in it is your team's.

What figure 1 shows

Section titled “What figure 1 shows”
Part of the diagramWhat it is
Top bandYour Azure tenant. One service principal, holding two scoped roles granted at management group or subscription scope, reads five gated sources across every subscription you pick. Data sources lists every source, endpoint, and role.
Middle bandInfralign. The nightly run, 02:30 to 06:15 (UTC). What is read lands as bronze parquet, then is shaped into a gold warehouse. Dashboards, reports, chatbot, and findings all build from gold.
Bottom bandYour team. You approve or reject each finding, and no change is prepared without that step.
Dashed laneThe optional FOCUS export for estates that outgrow the nightly window, joining bronze instead of the daily Cost Details API. Not part of the default path. See FOCUS exports and storage setup.

No arrow points back: the flow cannot create, modify, or delete a resource, tag, or export. To revoke collection access, remove both role assignments or disable the service principal. New collection stops after Azure RBAC and authentication changes propagate.

Where your data lands

Section titled “Where your data lands”

The nightly run copies your billing and resource metadata into Infralign’s warehouse in Microsoft Azure, Italy North (EU). Each tenant gets its own isolated databases; data is encrypted in transit with TLS and at rest on Azure-managed storage. Metadata only. Never credentials, and never data inside your resources. Security and data handling covers hosting, isolation, retention, and deletion.

Next: Dashboards. The four persona dashboards the gold warehouse feeds.