Azure Onboarding Process (Manual)

Use this path when your security team prefers to create Azure resources by hand (for example hardened storage policies) instead of running the Cloud Shell script or the in-app keyless wizard.

Note: Prefer automated setup? Use Azure Onboarding Process (federated workload, no client secret) or the Cloud Shell script (client-secret wiv_account).

Warning: This guide is for blob-only FOCUS cost export. Wiv does not require Synapse for new integrations. Wiv authenticates to Blob with Entra ID (OAuth) and Storage Blob Data Reader — not Storage Keys.

What you create

Prerequisites

• Billing account visible to your login (EA, MCA, or CSP partner MCA)

• Rights to create app registrations, role assignments, storage, and Cost Management exports

• A host subscription for the resource group and storage account

1. Create the app registration

1. Open Azure Portal.

2. Go to Microsoft Entra ID → App registrations → New registration.

3. Name the app (for example wiv_account).

4. Choose Accounts in this organizational directory only (single tenant) unless you have a reason not to.

5. Click Register.

6. Copy Application (client) ID and Directory (tenant) ID.

7. Open Certificates & secrets → New client secret. Save the Value immediately (shown once).

2. Grant billing and subscription roles

Billing account

• EA — Grant the app Enrollment Reader on the billing account.

• MCA / CSP partner — Grant Billing account reader on the billing account (all profiles).

Warning: EA only: Under Cost Management + Billing → Policies, enable Account owners can view charges. Without this, the app can have the role and still be denied cost data.

On each subscription you want Wiv to see, assign Reader, Monitoring Reader, and Cost Management Reader. For a PoC, grant these only on the subscriptions you choose.

3. Create storage for the FOCUS export

In a host subscription of your choice:

1. Create a resource group (for example rg-wiv).

2. Create a StorageV2 account with allowSharedKeyAccess=false, HTTPS only, and allowBlobPublicAccess=false.

3. Create a blob container (default name Wiv expects: billing-exports).

Note: publicNetworkAccess can stay Enabled so Wiv can reach the account over HTTPS with OAuth. That is not the same as anonymous public blobs.

4. Create the FOCUS cost export

At billing-account scope (preferred):

Grant the export identity write access if needed, then grant your app Storage Blob Data Reader on the storage account. Run Run now and wait for part_*.snappy.parquet under the export path.

5. Values to enter in Wiv

In Wiv: Integrations → Azure → New Azure Integration (manual / client-secret form).

Defaults if unchanged: container billing-exports, root folder billing-data, export name WivFocusDailyExport.

{
  "auth_method": "client_secret",
  "tenant_id": "<tenant>",
  "app_id": "<app id>",
  "client_secret": "<secret>",
  "billing_account_name": "<billing account name>",
  "billing_query_backend": "blob",
  "billing_storage_account": "<storage account>",
  "billing_container": "billing-exports",
  "billing_root_folder": "billing-data",
  "billing_export_name": "WivFocusDailyExport",
  "subscription_id": "<host subscription id>"
}

Note: If you use the Cloud Shell script instead, it prints this JSON at the end for you to paste or share.

6. Optional Microsoft Graph permissions

Only if your Wiv workflows need directory reads: add Microsoft Graph application permissions User.Read.All and Group.Read.All (or Directory.Read.All) and grant admin consent.

Troubleshooting

Important notes

• Store the client secret in a secret manager and rotate before expiry.

• Role and billing grants can take several minutes to propagate.

• Do not delete the app registration while the Wiv integration is active.