Reference
Data sources
Six Azure sources, and nothing else. This is the endpoint list to attach to a firewall or change record, with the api-version each one is called at.
The platform reads six Azure sources and nothing else: no agents on your VMs, no network taps, no access to data inside your resources. The permissions reference maps each source to the role that grants it.
Azure sources
Section titled “Azure sources”Each source is read through the two-role service principal: Cost Management Reader for the cost report, Reader for everything else.
The table below is the canonical list. Permissions describes the two roles and Entra app registration is the click path for granting them, but neither keeps its own copy of these endpoints. If you need the list for a firewall rule or a change record, take it from here.
| Source | Endpoint · api-version | Role | What it’s used for |
|---|---|---|---|
| Azure Cost Details API | POST …/Microsoft.CostManagement/generateCostDetailsReport · 2024-08-01 (ActualCost + AmortizedCost) | Cost Management Reader | The daily Cost API lane; dashboards, reports, audit baselines, savings verification |
| Azure Resource Graph | POST …/Microsoft.ResourceGraph/resources · 2022-10-01 (also AdvisorResources + ResourceChanges tables) | Reader | Resource inventory and metadata; mapping cost to what’s deployed; orphaned-disk detection |
| Azure Advisor | Microsoft.Advisor/recommendations/read (via Resource Graph) | Reader | An input signal for findings, enriched with utilisation evidence |
| Azure Monitor metrics | GET {resourceId}/providers/microsoft.insights/metrics · 2023-10-01 | Reader | Idle-VM detection and rightsizing confidence levels |
| Azure Activity Log | GET …/Microsoft.Insights/eventtypes/management/values · 2015-04-01 | Reader | ”What changed” context behind cost movements |
| Azure Retail Prices | GET https://prices.azure.com/api/retail/prices | None (public) | € impact on findings; Reservation and Savings Plan coverage views |
These six power the visibility tier and the audit baseline. When the first of that data reaches a screen is covered on dashboards.
Three things a reviewer usually asks about this table:
- Monitor metrics, never Monitor logs.
Microsoft.Insights/metricsandMicrosoft.OperationalInsightsare different providers. The nightly run reads the first and never queries the second, so no Log Analytics workspace is read, no matter what Reader would permit. Metrics are what size an oversized VM or spot an idle disk from its own utilisation rather than from its price. - Resource Graph reads a change table. Inventory queries also hit the ResourceChanges table, which needs
Microsoft.Resources/changes/read. Reader’s blanket*/readcovers it. A custom role has to name it, and without it the change context disappears silently rather than failing. - Reservation and savings-plan coverage needs no permission of its own. No reservations API is called. Coverage comes out of the amortised cost rows, where a commitment appears as a benefit identifier on the charge, so it is a cost-record fact rather than a separate grant.
Appendix lane: FOCUS 1.2 exports
Section titled “Appendix lane: FOCUS 1.2 exports”For estates whose daily Cost Details export outgrows the nightly window, an optional export-based lane reads native FOCUS 1.2 parquet via azcopy from a storage container you control. It needs an extra storage grant and trails the daily lane on freshness, so it is documented separately in FOCUS exports and storage setup.
The nightly run
Section titled “The nightly run”Ingestion runs once a night, fanning out across every subscription you’ve granted (10+ in a production estate). Each run moves through fixed stages:
| Time | Stage | What happens |
|---|---|---|
| 02:30 | Acquire | Pull from every source above |
| 03:45 | Derive | Shape raw data through the medallion warehouse (bronze → silver) |
| 04:45 | Build | Build gold tables and marts |
| 05:45 | Sync | Refresh the dashboards against the new data |
| 06:15 | Ready | The night’s data is in place and the dashboards are serving it |
On first connection Infralign backfills up to 13 months of cost history, so dashboards and reports open with trend rather than a single day.
What is never read
Section titled “What is never read”- Data inside your resources: database contents, VM filesystems, blob data (other than the FOCUS export container), application logs, or secrets.
- Workload or resource-configuration writes. Permissions lists every role action and a least-privilege custom role.
Progressive attribution
Section titled “Progressive attribution”Revoking access
Section titled “Revoking access”Remove both role assignments, or disable the service principal. New collection stops once the RBAC and authentication changes propagate. The full procedure, including what happens to data already collected, is in ending the connection.
Retention and deletion
Section titled “Retention and deletion”Your data is retained while the service is active. What happens when it stops, and which parts of that are agreed rather than implemented, is in ending the connection.