Required Azure Permissions
Permissions Noros requires from your Azure account.
Noros follows the principle of least privilege. We request only the minimum permissions necessary to provide cost visibility and optimization insights for your Azure environment.
Azure uses Workload Identity Federation, so no client secret and no certificate is created in your tenant. There is nothing to rotate, leak, or expire.
What Noros Cannot do
Read the contents of any resource. This covers database rows, Key Vault secret values, log records, and blob data outside the container created for your cost exports.
Create, modify, or delete any Azure resource.
Access keys, secrets, passwords, or any other credential in your environment.
Run Log Analytics queries. That needs the Log Analytics Reader role, which Noros is not granted.
Make purchases, modify subscriptions, or change billing settings.
Permission Groups Explained
Noros receives five role assignments. Every one of them is read-only.
Storage Blob Data Reader
The cost-export container only
Read the export files. No other container and no other storage account is reachable.
Cost Management Reader
Billing account
Query cost data through the Cost Management API.
Reservations Reader
Microsoft.Capacity provider
Read your reservation details for commitment coverage and utilization.
Savings Plan Reader
Microsoft.BillingBenefits provider
Read your savings plan details for the same reason.
Reader
Tenant-root management group
Read resource configuration and metrics for right-sizing. See below.
About the Reader role
Reader is the one grant not narrowed to a single provider. It grants */read: read access to the configuration and metadata of every resource in the tenant, plus resource metrics through Azure Monitor. Noros uses it to size and right-size your compute, reading Virtual Machine and Virtual Machine Scale Set inventory and their CPU, network, and disk metrics.
It is assigned at the tenant-root management group because Azure RBAC inherits downward. One assignment covers every subscription in your billing account, so Noros never has to enumerate them.
Reader carries no dataActions, so it cannot read the contents of anything. It grants no write access, no delete access, and no configuration access of any kind.
Noros asks for Reader rather than Azure's built-in Monitoring Reader. Monitoring Reader covers the same reads and adds Microsoft.Support/*, which includes the ability to open support tickets in your tenant. Noros does not need that, so it asks for the smaller role.
Security Model
No stored secrets. Authentication uses Workload Identity Federation, so there is no client secret and no certificate.
Short-lived tokens. Access tokens are valid for one hour and are obtained on demand.
Auditable. Every authentication event appears in your Entra ID sign-in logs.
Revocable. Delete the App Registration or the Federated Credential to revoke all access immediately.
Last updated