Valistry

Azure cost management

Daily cost of every Azure service. Line by line, split by your tags. Every subscription you give it. Never resource contents or logs.

Access

Kind
Sign in on the vendor's page; nothing typed here
What to give
Read-only service principal
Why that one
An Entra application with Reader on your subscriptions or their management group. Reader reads cost and usage; Cost Management Reader alone reads cost only. Valistry only reads.

What it attributes on its own

From the source
day; service as Azure bills it; meter; the GPU meters; subscription; what Azure charged; the resource each AI line was spent on, and how much of it ran; your resource tags; your resource groups' tags
Needs a rule or a trace
the model and the tokens — a GPU hour and a Document Intelligence page have neither; Azure OpenAI and partner models, which have their own source that does carry tokens; team, workflow and agent (your tags or a rule can give them); outcome

The addresses it calls

  • https://login.microsoftonline.com/
  • https://management.azure.com/subscriptions/
  • https://management.azure.com/subscriptions?api-version=
  • https://management.azure.com/providers/Microsoft.Management/managementGroups/
  • https://management.azure.com/providers/Microsoft.Billing/billingAccounts/
  • https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=
  • https://<Microsoft's report storage>.blob.core.windows.net/ (the cost details report: one file a link Azure gives)

Valistry calls only these addresses. It blocks any other call and logs every call.

Connecting it

  1. Register the app. Click New registration, or open your Valistry app. Then Register. Open ↗
  2. Make its password. In the app: Certificates & secrets → New client secret → Add. Open ↗
  3. Give the app Reader. Management group or subscription → Access control (IAM) → Add role assignment Open ↗

Azure OpenAI and partner models are left off these rows and reported beside them; connect Azure OpenAI for them. Only a billing account? Enterprise Agreement: an Enterprise Administrator gives the app EnrollmentReader through Microsoft's API. Microsoft Customer Agreement: give it Billing account reader in the portal. Then type the billing account as the scope.