> For the complete documentation index, see [llms.txt](https://docs.noros.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.noros.ai/getting-started/permissions-required/required-azure-permissions.md).

# Required Azure Permissions

Permissions Noros requires from your Azure account.

Noros follows the principle of least privilege. We request only the minimum permissions necessary to provide cost visibility and optimization insights for your Azure environment.

Azure uses Workload Identity Federation, so no client secret and no certificate is created in your tenant. There is nothing to rotate, leak, or expire.

***

### What Noros Cannot do

* Read the contents of any resource. This covers database rows, Key Vault secret values, log records, and blob data outside the container created for your cost exports.
* Create, modify, or delete any Azure resource.
* Access keys, secrets, passwords, or any other credential in your environment.
* Run Log Analytics queries. That needs the Log Analytics Reader role, which Noros is not granted.
* Make purchases, modify subscriptions, or change billing settings.

***

### Permission Groups Explained

Noros receives five role assignments. Every one of them is read-only.

| Role                     | Scope                              | Why it is needed                                                                     |
| ------------------------ | ---------------------------------- | ------------------------------------------------------------------------------------ |
| Storage Blob Data Reader | The cost-export container only     | Read the export files. No other container and no other storage account is reachable. |
| Cost Management Reader   | Billing account                    | Query cost data through the Cost Management API.                                     |
| Reservations Reader      | Microsoft.Capacity provider        | Read your reservation details for commitment coverage and utilization.               |
| Savings Plan Reader      | Microsoft.BillingBenefits provider | Read your savings plan details for the same reason.                                  |
| Reader                   | Tenant-root management group       | Read resource configuration and metrics for right-sizing. See below.                 |

{% hint style="info" %}
If Reservations Reader or Savings Plan Reader is missing, the connection still completes. Noros cannot read your commitment inventory in that case, so commitment coverage and utilization answers will be incomplete.
{% endhint %}

#### About the Reader role

Reader is the one grant not narrowed to a single provider. It grants `*/read`: read access to the configuration and metadata of every resource in the tenant, plus resource metrics through Azure Monitor. Noros uses it to size and right-size your compute, reading Virtual Machine and Virtual Machine Scale Set inventory and their CPU, network, and disk metrics.

It is assigned at the tenant-root management group because Azure RBAC inherits downward. One assignment covers every subscription in your billing account, so Noros never has to enumerate them.

Reader carries no `dataActions`, so it cannot read the contents of anything. It grants no write access, no delete access, and no configuration access of any kind.

Noros asks for Reader rather than Azure's built-in Monitoring Reader. Monitoring Reader covers the same reads and adds `Microsoft.Support/*`, which includes the ability to open support tickets in your tenant. Noros does not need that, so it asks for the smaller role.

***

### Security Model

* **No stored secrets.** Authentication uses Workload Identity Federation, so there is no client secret and no certificate.
* **Short-lived tokens.** Access tokens are valid for one hour and are obtained on demand.
* **Auditable.** Every authentication event appears in your Entra ID sign-in logs.
* **Revocable.** Delete the App Registration or the Federated Credential to revoke all access immediately.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.noros.ai/getting-started/permissions-required/required-azure-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.