Valistry

Azure cost management

One Cost Management query: the daily cost of every service and meter on the subscription. Never a resource, never a log, never anything but money.

Access

Kind
A read-only key you paste
What to give
Read-only service principal
Why that one
An Entra application with Cost Management Reader on the subscription. Valistry runs one cost query and nothing else.

What it attributes on its own

From the source
day · service as Azure bills it · meter · the GPU meters · subscription · what Azure charged
Needs a rule or a trace
the model and the tokens — a GPU hour and a Document Intelligence page have neither · Azure OpenAI, which has its own source that does carry tokens · team, workflow and agent unless a rule maps the service · outcome

The addresses it calls

  • https://login.microsoftonline.com/
  • https://management.azure.com/subscriptions/

Only these. A call anywhere else is refused before it leaves, and every call is logged.

Connecting it

  1. Use the application you already registered, or register one. The Azure OpenAI source asks for the same application, so one can serve both. Open ↗
  2. Create a client secret. Certificates & secrets → New client secret. Copy the Value, not the Secret ID — the value is shown once.
  3. Give it Cost Management Reader on the subscription. Subscription → Access control (IAM) → Add role assignment. It is read-only and cannot change a resource. Open ↗
  4. Paste the four values and click Test and connect. Valistry reads the last seven days, reports which services it found and which it left out, then fills thirty.

Azure OpenAI is left off these rows on purpose and reported beside them; connect Azure OpenAI for it, which reads token counts too. Cost Management Reader can be scoped to a resource group rather than the subscription, and the ledger then covers that group only.