Set up Advanced Credentials, Azure Rightsizing and Reserved Instance Planning

Azure Subscription level credentialing unlocks the following features within Cloudability :

• Apply resource group tags to resources within the resource groups

  Learn about Tag mapping

• Optimization - through Rightsizing, and Reserved Instances (RIs)

  Learn about Get recommendations for scaling your cloud resources with Rightsizing

  Learn about The Reservation Portfolio

Currently, our platform uses a custom role called “CloudabilitySubscriptionDataReader” on Subscriptions with the below mentioned permissions in order to fetch the necessary data:

• Microsoft.Compute/virtualMachines/read
• Microsoft.Compute/virtualMachines/extensions/read
• Microsoft.Compute/disks/read
• Microsoft.Sql/servers/databases/read
• Microsoft.Sql/servers/read
• Microsoft.Sql/servers/elasticpools/read
• Microsoft.Insights/metricDefinitions/read
• Microsoft.Insights/metrics/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Authorization/roleAssignments/read
• Microsoft.Insights/Metricnamespaces/Read
• Microsoft.Consumption/usageDetails/read
• Microsoft.Consumption/pricesheets/read
• Microsoft.CostManagement/query/read
• Microsoft.Commerce/UsageAggregates/read
• Microsoft.Commerce/RateCard/read
• Microsoft.Network/networkInterfaces/read

We use the OAuth 2.0 Authorization Grant Flow to register our application and create a service principal within the Azure tenant. You can read more about this process here: https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals

Before you begin

You must meet the minimum requirements for successful credentialing.

• You are a Cloudability Administrator. The Cloudability Administrator role gives you access to the Vendor Credentials page where you can manage your credentials.

  Learn about Re-validate, archive, or delete credentials

• You have one of the following Azure Active Directory roles in your organization:
  • Global Administrator
  • Application Developer
  • Cloud Application Administrator

  This is necessary for the OAuth 2.0 Authorization Grant Flow. See https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals

  Your Azure Active Directory (AD) role is used to register our enterprise app within your Azure AD tenant, and create the Service Principal.

• You are an Owner (or higher) on the Subscription you are credentialing. This is necessary for the OAuth 2.0 Authorization Grant Flow. See https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals . You need to be at least an Owner on the Subscription so that permissions can be attached to the Service Principal through IAM.

Enable Custom read-only role on a Subscription

The following steps assume that you have already added an Azure EA to Cloudability 's Vendor Credentials page. Also, you have one or more Subscriptions listed on that page for which you would like to provide us access.

Learn about Set up Cost Management for new Cloudability Azure Enrollment Agreement (EA) customers

1. In Cloudability , edit the subscription. Select the Edit icon for the Subscription for which you would like to provide Cloudability access.
2. Select the Generate Link button to generate a URL for each selected Subscription that you will then use to complete the OAuth 2.0 Authorization Grant Flow for each of those Subscriptions.
   1. Select Select Subscriptions.
   2. Choose Optimization options as Read Only vs Optimize Resources .
   3. Select the Subscription(s) for which to generate link(s).
   4. elect Ok to complete your selections.
   5. Select Generate Links. A link is generated for each Subscription that you selected.
3. Select each link to complete registering our application and creating a service principal.
4. Complete the OAuth 2.0 flow triggered from the link.
5. Accept the CloudabilityUtilizationDataCollector to complete the consent process.
6. Verify successful consent in the Azure portal:
   • Active Directory. You can verify that the application has been successfully consented to by checking the Enterprise applications section in your Azure Active Directory.
8. Subscription IAM. You can check whether the service principal is a assigned the custom role ‘CloudabilitySubscriptionDataReader’ on the subscription.

Confirm that you have successfully credentialed your subscription

Return to the Vendor Credentials page in Cloudability to verify credentials.

You may see a yellow or green check box, in the Advanced Features column, for the Subscription.

• A green check box for a Subscription indicates that Cloudability has,
  • a custom read-only role on the Subscription (through our service principal)
• A yellow check box implies that Cloudability has an incomplete credential, for example the credential process could have started (i.e., we have a record in our database) but there are no permissions attached to that credential.
• A red status color for the credential implies that there's an error with the credential.

1. Re-verify the credential by clicking on the circular arrow.

   A check mark is displayed briefly upon successful verification.

   

   You may need to refresh the browser to fetch new changes.

2. Select to view the updated permissions.
3. Check whether you have the CloudabilitySubscriptionDataReader role on the subscription. This role on the subscription is identified by these 11 permissions shown in green tick marks.

Click here to Set up Azure Memory Metrics Collection