User cost attribution (UCA) Azure resources and permissions

Avatar
Nerdio Product Support

When you enable user cost attribution (UCA), Nerdio Manager deploys a small set of Azure resources in your tenant to collect, store, and report cost data. This article describes what each resource does, how the resources communicate with each other and with Nerdio Manager, and the roles and access policies that they need. Use it to understand what is deployed in your environment and to review the permissions with your security team.

For the prerequisites and the steps to deploy these resources, see User cost attribution overview and Enable user cost attribution.

Azure resources

Enabling user cost attribution deploys an App Service, a storage account, and a key vault. The following table describes what each resource does and what it communicates with.

Resource

What it does

Communicates with

App Service

Hosts all user cost attribution code and functionality, including data fetching, report reading and writing, self-diagnostics, and miscellaneous operational tasks.

All functionality is controlled through a REST API. Every API request must be authenticated with an API key, which is stored in the associated key vault.

  • Azure APIs: Fetches cost data, user session data, and other resource information from Azure.

  • Storage account: Reads and writes raw report data (for example, costs), key reports, operational logs, and miscellaneous information (for example, configuration data and currency information).

  • Key vault: Reads the stored API key that authenticates interactions with the Nerdio Manager App Service, and the stored secondary API key that authenticates Power BI operations.

  • Nerdio Manager App Service: Communicates actively with it to provide functionality in the Nerdio Manager console, such as displaying report data and building reports. All requests are authenticated with the associated API key.

  • Power BI connector (optional): See Optional Power BI connector.

Storage account

Stores all the data that user cost attribution needs to operate. This includes all raw report data (costs, sessions, resources, and so on), calculated report files, and miscellaneous items such as configuration data and currency information.

  • User cost attribution App Service: As described above.

  • Nerdio Manager App Service: Uses a shared access signature (SAS) token that the user cost attribution App Service generates, to fetch the report data it needs directly and display it in the Nerdio Manager console.

Key vault

Stores the API keys and application secrets that user cost attribution needs to operate. Both the user cost attribution App Service and the Nerdio Manager App Service read the stored API keys to authenticate the communication between them.

  • User cost attribution App Service: Uses the secret Get and Set permissions to identify and view the API keys.

  • Nerdio Manager App Service: Uses the secret Get and Set permissions to identify and view the API keys. It also creates and stores the API keys when the user cost attribution resources are deployed.

Optional Power BI connector

The optional Power BI connector lets you import user cost attribution reports into Power BI. The import is authenticated with the secondary API key, which can authorize only specific Power BI functionality. The user cost attribution App Service acts as an intermediary for the import. The Power BI connector never accesses the storage account directly. For details, see User cost attribution combine reports using Power BI.

Architecture

The following diagram shows how the user cost attribution resources, the Azure data sources, Nerdio Manager, and the optional Power BI connector and gateway communicate. The key vault, the app registration, and the authentication processes are not shown.

Architecture diagram. Azure data sources (a Log Analytics workspace, Cost Explorer, usage data, and Desktop Virtualization data) feed the user cost attribution App Service, which builds reports and reads and writes report files in the storage account. The App Service communicates with the cost attribution pages in the Nerdio Manager console. An optional custom Power BI connector moves report files from the App Service into Power BI Desktop on a local computer. Reports can be published to a Power BI workspace, refreshed through an on-premises data gateway, and connected to an Excel file.

Permissions

Initial setup

The user who enables user cost attribution must hold one of the following tenant-level roles in Microsoft Entra ID: Global Administrator, Cloud Application Administrator, or Application Administrator. This is a one-time requirement, needed only to create the app registration. For the full list of prerequisites, including the subscription-level roles, see User cost attribution overview.

Role assignments

User cost attribution needs the following role assignments to complete its reporting and functionality. Keep them in place at all times. They are assigned to the service principal of the app registration that was created for user cost attribution.

Scope

Role

Subscription

Cost Management Reader

Subscription

Desktop Virtualization Reader

Subscription

Log Analytics Reader

Subscription

Monitoring Reader

The storage account that was created for user cost attribution

Storage Blob Data Contributor

Key vault access policies

The key vault needs the following access policies:

Permissions

Principal

Secret permissions: Get, Set

The managed identity of the user cost attribution App Service

Secret permissions: Get, Set

The managed identity of the automation account

Need help?

Raise a support ticket for this item.

Was this article helpful?

0 out of 0 found this helpful
Have more questions? Submit a request

Comments (0 comments)

Article is closed for comments.