Prerequisite Checklist

Azure onboarding requires two checks before you begin.

Verify both on the onboarding user account. If you skip them, onboarding fails.

1. User Access Administrator role at root scope

Archera creates a custom RBAC role inside your Azure tenant.

Make sure your onboarding user has Access management for Azure resources enabled.

This is a hard requirement BEFORE beginning Archera's Azure onboarding.

If you don't verify or action this step, the onboarding will fail.

NOTE: The "onboarding user" will be whoever from your company executes the Archera onboarding process.

We are NOT asking for you to grant Archera these permissions. We are ensuring your personnel has sufficient permissions in your environment to complete the process.

Global Administrator + Entra properties toggle on

1. Go to Microsoft Entra ID → Users.

2. Select the onboarding user.

3. Open Assigned roles.

4. Add Global Administrator in the role directory.

5. Go to Microsoft Entra ID → Overview → Properties.

6. Turn on Access management for Azure resources if it is off.

7. Click Save to apply.

You can find this setting in: Microsoft Entra ID > Overview > Properties

This toggle only needs to be enabled for your personnel for the duration of onboarding.

You can disable it after onboarding completes.

2. Contributor role at subscription scope

Your designated "onboarding user" needs Contributor RBAC role at subscription scope.

NOTE: The "onboarding user" will be whoever from your company executes the Archera onboarding process.

We are NOT asking for you to grant Archera these permissions. We are ensuring your personnel has sufficient permissions in your environment to complete the process.

This contributor access is only required for the single subscription as detailed below.

• When you provide your Azure Tenant ID and Subscription ID in the first stage of onboarding flow, this subscription will house a Resource Group and Storage Account to store Cost Exports.

  • Microsoft requires Cost Exports to live in a storage account in your own Azure estate.

• We create those resources on your behalf later in the onboarding flow. In order to facilitate that, we need the contributor access to just the one sub.

Yes, you can onboard more than one subscription at a time. We just need one of your subs earmarked to hold the cost exports for all of the subscriptions you choose to onboard into Archera.

Related Resources

• Azure Onboarding - Supported Account / Subscription Types

• Azure Onboarding - Required Permissions

• Does Archera Rely on Azure Exchanges or Returns Policy?

• Does Archera Support Reservations for Azure Storage Disks?

• Azure Offboarding