> For the complete documentation index, see [llms.txt](https://docs.archera.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.archera.ai/help-center/sign-in-and-security/azure-access.md). # How Does Archera Access My Azure Environment? Archera reads your Azure cost and usage data through an **enterprise application** (a service principal) in your own Microsoft Entra tenant. Because the access belongs to an application rather than a person, it is unaffected if an employee changes their password, loses access, or leaves your company. ## What Archera can and cannot do Archera's access is **read-only across your environment**, with two deliberate exceptions. | | | | ---------- | ------------------------------------------------------------------------------------------------------------------ | | **Can** | Read cost and usage data, billing details, subscription and resource metadata, and Azure Advisor recommendations | | **Can** | Create and read the cost exports Archera depends on | | **Can** | Read, purchase, and manage reservations and savings plans — only if you install Archera for full rate optimization | | **Cannot** | Create, modify, or delete virtual machines, databases, networks, or any other workload resource | | **Cannot** | Read the contents of your storage accounts, other than the one Archera creates for cost exports | | **Cannot** | Grant access to anyone else, anywhere outside the single storage account Archera creates | The two write exceptions are the storage account that holds your cost export files, and your reservations and savings plans. Nothing else. {% hint style="info" %} Holding a purchase role is not the same as purchasing. Archera buys nothing until you approve a commitment plan in the product. {% endhint %} ## Access scope Archera's main read role is a **custom role** created in your tenant during onboarding, assigned at the **tenant root group**. Tenant-level assignment is what lets Archera see every subscription you connect without a separate grant for each one. The role contains read actions only — no write, delete, or role-assignment permissions. Several narrower roles are assigned alongside it, each at the tightest scope Azure permits: * Storage read roles, scoped to the one storage account Archera creates * `User Access Administrator`, scoped to that same storage account **and nothing else** — required because Azure Cost Management delivers export files using a managed identity that must first be granted access to the destination container * Reservation and savings plan roles, scoped to the `Microsoft.Capacity` and `Microsoft.BillingBenefits` providers * An Azure Advisor role, scoped to the `Microsoft.Advisor` provider * A billing role on your billing account, if you onboard at the billing-account level For the complete list, including every role name, scope, and the reason it is needed, see [Azure Onboarding - Required Permissions](/help-center/azure-onboarding/technical-onboarding/required-permissions.md). ## What Archera creates All of it lives inside the one subscription you nominate during onboarding, and you own all of it: * One **resource group** * One **storage account**, which holds your cost export files * One **blob container** inside it, created by Azure when the first export is written * One **custom role definition** Archera does not create resources anywhere else in your environment. ## Where your data lives Cost export files are written by Azure into **your** storage account, in **your** subscription, in the region you choose during onboarding. Archera reads from that location. Microsoft requires cost exports to be delivered to a storage account inside your own tenant. ## Removing access Every role can be revoked and every resource deleted at any time, and you can do it without Archera's involvement. See [Azure Offboarding](/help-center/azure-onboarding/offboarding/offboarding.md). ## Related Resources * [What information does Archera require to connect to my Azure account?](/help-center/azure-onboarding/technical-onboarding/required-information.md) * [Azure Onboarding - Required Permissions](/help-center/azure-onboarding/technical-onboarding/required-permissions.md) * [Azure Onboarding - Prerequisite Checklist](/help-center/azure-onboarding/technical-onboarding/prerequisite-checklist.md) * [Azure Offboarding](/help-center/azure-onboarding/offboarding/offboarding.md) * [How Does Archera Access my AWS Environment?](/help-center/sign-in-and-security/aws-access.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.archera.ai/help-center/sign-in-and-security/azure-access.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.