Valistry

Azure OpenAI

Azure OpenAI and Foundry cost, by day. Token counts and your tags. Every subscription you give it, with the cost of Claude and other partner models bought in Marketplace. Never prompts, replies or other services' cost.

Access

Kind
Sign in on the vendor's page; nothing typed here
What to give
Read-only service principal
Why that one
An Entra application with Cost Management Reader and Monitoring Reader on your subscriptions or their management group. Valistry reads the cost queries and the token metrics, nothing else. The secret is tested, then stored encrypted; you see its last four characters.

What it attributes on its own

From the source
day; subscription; model; model deployment; region; what Azure charged per meter; prompt and generated tokens; cached prompt tokens on Anthropic deployments; partner models bought in Azure Marketplace; your resource tags
Needs a rule or a trace
team, workflow and agent unless your tags carry them — Azure meters carry no caller; outcome; per-request detail — that needs the AzureOpenAIRequestUsage diagnostic log, a later source

The addresses it calls

  • https://login.microsoftonline.com/
  • https://management.azure.com/subscriptions/
  • https://management.azure.com/subscriptions?api-version=
  • https://management.azure.com/providers/Microsoft.Management/managementGroups/
  • https://management.azure.com/providers/Microsoft.Billing/billingAccounts/

Valistry calls only these addresses. It blocks any other call and logs every call.

Connecting it

  1. Register the app. Click New registration, or open your Valistry app. Then Register. Open ↗
  2. Make its password. In the app: Certificates & secrets → New client secret → Add. Open ↗
  3. Give the app two reader roles. Management group or subscription → Access control (IAM) → Add role assignment, once per role Open ↗

Only a billing account? Enterprise Agreement: an Enterprise Administrator gives the app EnrollmentReader through Microsoft's API, using its Object ID from Enterprise applications. Microsoft Customer Agreement: give it Billing account reader in the portal. Then type the billing account as the scope. Token counts still need Monitoring Reader on each subscription.

Settings worth turning on in the Azure portal

  1. Tag each resource. Add team and app tags. Cost analysis then splits cost by tag.
  2. Turn on tag inheritance. Subscription and resource group tags then reach every usage row.
  3. One Foundry project per team. Azure tags each project's usage, so cost splits by project.
  4. Set a budget. Azure emails you near the limit. It does not stop spend.

Questions about Azure OpenAI

What access does Valistry need?An app with two read roles on one subscription: Cost Management Reader and Monitoring Reader.
Does it read prompts?No. It reads what each meter cost and token counts per deployment.
Our Azure OpenAI is in several subscriptions.Connect each one. One connection reads one subscription.