Azure setup guide

Overview

This guide explains how to prepare your Azure account so that emma can access your billing data, and what credentials to provide during the connection setup.

emma reads your billing data from a storage container you control — it never accesses your workloads or infrastructure.

Before you start

You need access to Azure Portal with permissions to:

• Create Storage Accounts
• Create Cost Management Exports at your billing scope (EA Enrollment or MCA Billing account)
• Create App Registrations in Microsoft Entra ID

Step 1 — Create a Storage Account and Container

The container will receive your billing export files.

1. Open Azure Portal → Storage accounts → + Create.
2. Fill in:
   • Subscription, Resource Group, Region, Performance, Redundancy: according to your company policy.
   • Storage account name: any name (e.g. focusexportaccount)
   • Preferred storage type: any type, Blob Storage or ADLS Gen2 are both supported.
3. Click Review + create → Create.

1. Once created, open the storage account → Data storage (in left menu) → Containers → + Add container.
2. Enter a Container name (e.g. focus) and click Create.

Save the Storage account name and Container name — you will need them later.

Step 2 — Set up FOCUS billing export

1. Open Cost Management + Billing → Billing scopes.
2. Select the appropriate scope:

• EA (Enterprise Agreement): choose your Enrollment scope. MCA (Microsoft Customer Agreement): choose your Billing account scope.

4. Go to Settings → Exports → + Create.
5. Select template: Cost and usage (FOCUS).
6. In Datasets fill in Export prefix: any name (e.g. billing)
7. Under Destination:

• Storage type: Azure blob storage
• Storage account: the account from Step 1
• Container: the container from Step 1
• Directory: enter a path prefix (e.g. billing) — this is your Directory path
• Format: Parquet
• Compression: Snappy

14. Click Review + create → Create.

Save the Directory path — you will need it later.

Step 3 — Create an App Registration

This creates the service identity that emma will use to authenticate.

1. Open Microsoft Entra ID → Manage (left menu) → App registrations → New registration.
2. Enter a Name (e.g. emma-service-app). Leave other settings as default.
3. Click Register.

Step 4 — Copy Tenant ID and Client ID

On the Overview page of the newly registered app, you will see:

• Application (client) ID — this is your Client ID
• Directory (tenant) ID — this is your Tenant ID

Copy both values.

Step 5 — Create a Client Secret

1. In the same App Registration, go to Manage (left menu) → Certificates & secrets → New client secret.
2. Enter a description and choose an expiry period. Click Add.
3. Copy the Value immediately — it is shown only once.

This value is your Client Secret.

Step 6 — Assign Storage Blob Data Reader role to the App Registration

1. Open Storage accounts → your storage account → Containers → open the container from Step 1.
2. Go to Access control (IAM) → +Add → Add role assignment.
3. Role: Storage Blob Data Reader → Next.
4. Members: click + Select members, search for your App Registration by name (e.g. emma-service-app), select it → Select.

1. Click Review + assign.

Note: Azure RBAC changes can take a few minutes to propagate. If emma reports a permissions error immediately after setup, wait 2–3 minutes and try again.

What to enter in emma

Get GCP credentials