Connect Your Azure Account

Connect your Azure billing account to Noros. Noros guides the whole setup in the chat.

Noros connects to your Azure environment using read-only access to your Cost Management exports. Noros guides the whole setup in the chat, and generates a prefilled script for you to run. There are no values to fill in yourself.

Prerequisites

You need these before you start. The setup script checks for them.

• Azure CLI authenticated. Run az login.
• Application Administrator role in Entra ID.
• Contributor role on the target subscription.
• Billing Account Owner or Billing Account Contributor.
• Owner or User Access Administrator at the tenant root. The script assigns the Reservations Reader and Savings Plan Reader roles, and Contributor cannot assign them.

Onboarding Steps

Step 1: Start the Connection

Ask Noros to add an account, then select Azure. A progress card appears at the top of the conversation and tracks each step as you complete it.

Step 2: Provide Your Billing Details

Noros asks for your Billing Account ID and your Azure Subscription ID. The subscription is where the storage account is created, and it is separate from the billing account.

Noros also asks for your agreement type. Noros supports EA, MCA, and MPA. The format of the Billing Account ID depends on which one you use:

Agreement type	Billing Account ID format
MCA	A billing-scope string, in the form billing_account:billing_profile_date
EA	Your enrollment number
MPA	A subscription GUID

Step 3: Name the Account

Give the account a name. Noros uses this name in the account switcher and in its answers.

Step 4: Run the Setup Script

Noros generates a Bash script named north_azure_onboarding_v3.sh, already filled in with your values. Select Open Azure Cloud Shell, paste the script, and run it. Select I have run the script when it finishes.

The script creates four things:

• A storage account for your billing exports
• A blob container for the export files
• An app registration with a federated identity
• The read-only role assignments Noros needs

The script is idempotent. It detects resources that already exist and skips them, so it is safe to run again.

Step 5: Share the Four Output Values

The script prints four values when it finishes. Paste them back into the chat:

1. Tenant ID
2. Client ID, which is the App Registration ID
3. Storage Account Name
4. Container Name

Step 6: Verification

Noros verifies the connection by listing the exports container and reading from it. When this succeeds, Noros confirms that the account is verified and that it can read your billing exports.

If verification fails, the message names the cause. The usual reason is a missing role assignment on the app registration.

Security

Azure uses Workload Identity Federation, so no client secret and no certificate is created in your tenant. There is nothing to rotate, leak, or expire. Every role Noros receives is read-only.

For the full list of roles, their scopes, and the reason for each one, see Required Azure Permissions.

Connecting Additional Accounts

You can connect more than one Azure billing account. To add another, ask Noros in the chat and it guides you through the same steps.