Entra app registration

What you’ll need

• Role: application registration permission, plus Owner or User Access Administrator at the scope where you assign the roles
• Scope: a management group covering your subscriptions, or each subscription in turn
• Time: about 30 minutes for this page at management group scope, of which roughly 12 minutes is portal work and the rest is waiting for Azure to propagate the role assignments. The whole connection takes about 45 minutes; see connect Azure
• Tools: the Entra admin center and the Azure portal

Validated against the Azure portal on 27 July 2026. The role-assignment path was re-walked and captured on 6 August 2026.

Click any image to enlarge.

Three things have to exist in your tenant before the setup wizard can validate anything: an app registration, two role assignments, and a client secret. This page is the only portal walkthrough for all three. Connect Azure then owns the wizard, which asks for four values that come from here.

Infralign reads your Azure estate through this service principal, in your own tenant. You create it, you control it, and you can revoke it.

Before you start

Two checks, in this order. Each one costs a day when it surfaces late.

1. Send the consent request now. Nothing on this page needs a directory-wide admin role. The first sign-in to app.infralign.ai does: it raises a one-time consent dialog that only a Global Administrator, Privileged Role Administrator, or Cloud Application Administrator can approve. Their answer can take days, and the wait runs alongside the portal work below. Send your approver the consent URL and the four checks.

2. Check that you can assign roles at all. Open Access control (IAM) on the management group or subscription you plan to use, then select Add. If Add role assignment is greyed out, stop and read the warning below. It is the one prerequisite here with no workaround.

If Add role assignment is greyed out

You hold app-registration rights but not Owner or User Access Administrator at that scope. Nothing you can change on your side unblocks it. Find whoever holds it before you do anything else on this page.

What to send them:

• The scope: the management group name, or the subscription id.
• The two roles: Reader and Cost Management Reader.
• The app name you are about to create: infralign-reader.
• A link to what these roles cannot do. That is the first question they will ask.

If no Owner can be found, a Global Administrator has one further lever:

1. In the Entra admin center, set Entra ID → Properties → Access management for Azure resources to Yes. This grants them User Access Administrator at the root management group, which reaches every scope beneath it.
2. Once the two roles are in place, set the toggle back to No and remove the root-scope assignment. The lever does not lapse on its own.

View full size

Figure 1: Steps 1 to 4 happen inside your tenant. Deleting the assignments or the app registration stops the nightly run after Azure propagation.

The one-time admin consent your tenant grants is for the separate Infralign sign-in application. See dashboard sign-in. The roles granted here are the ones set out in the permissions reference.

Create the app registration

Figure 1 shows who does each step. The steps below are the portal path.

1. Sign in to the Microsoft Entra admin center as a user who can register applications.
2. In the left navigation, expand Entra ID and select App registrations.
3. Select New registration.
4. Enter a recognisable name, such as infralign-reader.
5. Under Supported account types, select Accounts in this organisational directory only.
6. Leave Redirect URI empty.
7. Select Register.
8. On Overview, record the Application (client) ID.
9. Record the Directory (tenant) ID.

Done when infralign-reader appears under App registrations and you have recorded both IDs.

Caution

Create the app registration in the same tenant you sign in to Infralign with. By default the wizard refuses a credential from a different directory.

Ask Infralign to switch cross-tenant connections on before you start. Two situations need them: an estate that spans tenants, and an admin who signs in from another tenant, such as a personal Microsoft account or a managed service provider.

The wizard then accepts the credential, and shows a notice that the app registration sits in a different Entra tenant.

Steps 8 and 9 both happen on the screen below. Both values sit in the Essentials panel, in the left column: Application (client) ID at the top, and Directory (tenant) ID two rows under it.

The Object ID between them is neither of them, and pasting it into the wizard is the second most common mistake on this path.

The infralign-reader app in these captures was deleted afterwards. Its three identifiers are blurred out of the Overview capture; the field labels and their positions are what the step needs.

Create a client secret

1. On the app, open Certificates & secrets → Client secrets.
2. Select New client secret.
3. Enter a description, such as infralign.
4. Select an expiry of 6 or 24 months.
5. Select Add.
6. Copy the secret Value immediately, not the Secret ID.
7. Note the expiry date Entra shows beside it.

Done when you hold the secret value and its expiry date.

Entra shows the value once. Copying the Secret ID instead of the Value is the most common mistake on this path. It surfaces later, as a refused sign-in in the wizard.

If the consent answer may take days, create the secret last. Nothing before the wizard needs it, and you can add a new secret at any time if the value is lost.

The expiry date is one of the four values the wizard asks for. It is what puts an amber badge on the connection page 30 days before the secret lapses. Without it the badge reads “Expiry unknown”.

Danger

Do not send the secret by email or chat. Paste it into the setup wizard, which is the only place Infralign accepts it. Anyone holding the value can authenticate as the service principal until it expires or you revoke it.

Rotate the secret from the connection page when it approaches expiry. Create the new secret in Entra first, then paste it in: the new value is validated before it replaces the old one, so a failed check changes nothing. See connect Azure.

Grant the required RBAC roles

This is Azure role-based access control, not API permissions.

Role	Why it is needed
Cost Management Reader	The daily lane calls POST …/providers/Microsoft.CostManagement/generateCostDetailsReport. This is an action, so Reader alone returns 403. Cost Management provides the report through signed SAS links; no storage role is needed.
Reader	Its */read covers Resource Graph inventory, the Activity Log, Monitor metrics, and Azure Advisor recommendations.

Choose the scope first

Scope	When to use it	Cost
Management group	You administer a management group covering the subscriptions you want processed	Two assignments for the whole estate, and every subscription created later is covered
Subscription	You do not administer a management group	Two assignments per subscription. Allow about a minute each

Management group scope is the recommendation and the single largest time saving on this page. Two assignments take about six minutes. Twenty subscriptions done one at a time is forty role assignments, and about twenty minutes on top of everything else here.

Do not use billing-account scope.

Reader grants control-plane metadata only. It can see that resources exist and how they are configured, never what is inside them. If your security team wants the detail, or a stricter alternative, see why Reader, and what it cannot see.

Assign the roles

This is the longest click path on the route. The captures below walk it on a subscription; a management group shows the same screens.

1. Open the management group, or the subscription, in the Azure portal.

2. Open Access control (IAM).

3. Select Add → Add role assignment.

   Greyed out? Stop here and read the prerequisite check at the top of this page. You are missing Owner or User Access Administrator at this scope, and no other step on this page changes that.

   

4. Choose Cost Management Reader.

5. Select Next.

   

6. On Members, keep User, group, or service principal selected.

7. Select Select members.

8. Search for infralign-reader.

9. Select the app.

   

10. Select Review + assign.

11. Repeat steps 3 to 10 for Reader.

Captured 6 August 2026 from a real subscription. The subscription name, the signed-in identity and the object ID are blurred. The infralign-reader in these captures was a throwaway registration, deleted after capture, and no role assignment was saved.

If you assign at subscription scope, repeat the whole procedure for every subscription you include.

Done when infralign-reader holds both roles at the scope you chose.

Caution

Wait up to ten minutes before validating. A role assignment that has not propagated returns AuthorizationFailed, which reads as a missing role and is not one.

Optional FOCUS export lane only

The optional FOCUS export lane adds one storage role, Storage Blob Data Reader on the export container, or a container SAS. It is not needed here. See FOCUS exports and storage setup.

What each role unlocks

Cost Management Reader unlocks one thing: the Cost Details report action. That is the daily cost lane, and the dashboards, reports, and audit baselines built on it. Without it the report action returns 403 and no spend data arrives at all.

Reader unlocks the four other Azure sources: Resource Graph inventory, the Activity Log, Monitor metrics, and Azure Advisor. Those are the context that turns a charge into a finding. Without Reader on a subscription, cost still arrives but the subscription itself is invisible to discovery, so in practice nothing arrives either.

The endpoint-by-endpoint version of this, with api-versions and what breaks without each source, is the data sources reference. That is the table to attach to a firewall change record, and it is the only copy of it.

What happens next

Open the setup wizard and paste in the four values: the Directory (tenant) ID, the Application (client) ID, the client secret Value, and the secret’s expiry date. The wizard signs in as infralign-reader, checks both roles on every subscription it can see, and reads one day of cost data. It stores nothing until you confirm.

The four steps are described in connect Azure.

Prefer to prove the access from your own shell first, or need the commands for a change record? Use the CLI validation runbook.

To revoke access, delete the role assignments or the app registration. The nightly run stops reading when Azure enforces the change after propagation.

The service principal above is for ingestion only. Your own users sign in to the dashboards through the multi-tenant Infralign sign-in application, with their existing Microsoft work account.

---

Next: Dashboard sign-in. Your approver’s consent request lands there, and it is where you read the grant back. Then Connect Azure for the wizard. If the consent request you sent before you started is still waiting, chase it now: the wizard’s first sign-in needs the answer.