Granting GraphPaaS access to your Azure costs

GraphPaaS reads your Azure spend through the Azure Cost Management API. To light up the Bills page, a user with read access to your subscriptions connects their Azure account once — GraphPaaS then syncs costs in the background. This guide walks an Azure administrator through granting that access.

What GraphPaaS needs

• A user account in your Azure tenant with read access to cost data on the subscriptions you want to track.
• That user clicks Connect Azure Billing once inside GraphPaaS.

Access is read-only. GraphPaaS never creates, modifies or deletes Azure resources.

Step 1 — Pick (or create) the connecting user

Any member of your Azure tenant works. Most customers use the same admin account that connected Microsoft 365, but a dedicated low-privilege account is fine too.

Step 2 — Assign the Cost Management Reader role

The built-in Cost Management Reader role grants exactly what GraphPaaS needs — cost and usage data, nothing else.

1. Open the Azure portal and go to Subscriptions.
2. Select the subscription you want GraphPaaS to report on.
3. Open Access control (IAM) → Add → Add role assignment.
4. On the Role tab pick Cost Management Reader.
5. On the Members tab select the connecting user from Step 1.
6. Review + assign.

Repeat for every subscription you want in the dashboard. If the user already holds a broader role (Reader, Contributor, Owner) on the subscription, no extra assignment is needed.

Step 3 — Connect inside GraphPaaS

1. Sign in to GraphPaaS with the connecting user.
2. Open Bills in the sidebar.
3. Click Connect Azure Billing and complete the Microsoft sign-in.

That's it. The first sync runs in the background; monthly spend, cost over time and per-service breakdowns appear once it finishes (usually within minutes).

Troubleshooting

• The Bills page stays empty — confirm the role assignment is on the subscription (not a resource group) and that the subscription is Enabled.
• Consent screen asks for an admin — your tenant restricts user consent; an Azure AD admin needs to approve the GraphPaaS application once, after which any permitted user can connect.
• Multiple subscriptions, only one shows — the connecting user needs the role on each subscription; GraphPaaS discovers every subscription it can read.

Questions? Reach us at hello@graphpaas.com.