Azure OpenAI
The Cost Management daily cost query for Azure OpenAI meters, and the token metrics on your Cognitive Services accounts. Never a prompt, never a response, never another service's cost.
Access
- Kind
- A read-only key you paste
- What to give
- Read-only service principal
- Why that one
- An Entra application with Cost Management Reader and Monitoring Reader on the subscription. Valistry reads the cost query and the token metrics, nothing else. The secret is tested, then stored encrypted; you see its last four characters.
What it attributes on its own
- From the source
- day · model · model deployment · region · what Azure charged per meter · prompt and generated tokens · cached prompt tokens on Anthropic deployments
- Needs a rule or a trace
- team, workflow and agent — Azure meters carry no caller · outcome · per-request detail — that needs the AzureOpenAIRequestUsage diagnostic log, a later source
The addresses it calls
- https://login.microsoftonline.com/
- https://management.azure.com/subscriptions/
Only these. A call anywhere else is refused before it leaves, and every call is logged.
Connecting it
- Register an application. Entra ID → App registrations → New registration. Open ↗
- Create a client secret. Certificates & secrets → New client secret. Copy the Value, not the Secret ID — the value is shown once.
- Give it two read roles on the subscription. Subscription → Access control (IAM) → Add role assignment. Both are read-only and neither can change a resource. Open ↗
- Paste the four values and click Test and connect. Valistry signs in with them, reads the cost and token counts, reports what each returned, and stores the secret only if the read succeeded.
Cost Management Reader can be scoped to a resource group rather than the subscription when Azure OpenAI lives in one. The cost query then covers that group only, and the ledger says so.