You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/cost-management-billing/automate/tutorial-seed-historical-cost-dataset-exports-api.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ ms.reviewer: jojoh
12
12
13
13
# Tutorial: Seed a historical cost dataset with the Exports API
14
14
15
-
Large organizations often need to analyze their historical costs going back a year or more. Creating the dataset might be needed for targeted one-time inquiries or to set up reporting dashboards to visualize cost trends over time. In either case, you need a way to get the data reliably so that you can load it into a data store that you can query. After your historical cost dataset is seeded, your data store can then be updated as new costs come in so that your reporting is kept up to date. Historical costs rarely change and if so, you'll be notified. So we recommend that you refresh your historical costs no more than once a month.
15
+
Large organizations often need to analyze their historical costs going back a year or more. Creating the dataset might be needed for targeted one-time inquiries or to set up reporting dashboards to visualize cost trends over time. In either case, you need a way to get the data reliably so that you can load it into a data store that you can query. After your historical cost dataset is seeded, your data store can then be updated as new costs come in so that your reporting is kept up to date. Historical costs rarely change and if so, you get notified. So we recommend that you refresh your historical costs no more than once a month.
16
16
17
17
In this tutorial, you learn how to:
18
18
@@ -28,9 +28,9 @@ You need proper permissions to successfully call the Exports API. We recommend u
28
28
- To learn more, see [Assign permissions to Cost Management APIs](cost-management-api-permissions.md).
29
29
- To learn more about the specific permissions needed for the Exports API, see [Understand and work with scopes](../costs/understand-work-scopes.md).
30
30
31
-
Additionally, you'll need a way to query the API directly. Some popular ways to query the API are:
31
+
Additionally, you need a way to query the API directly. Some popular ways to query the API are:
We recommend creating one-time data exports in one month chunks. If you want to seed a one-year historical dataset, then you should execute 12 Exports API requests - one for each month. After you've seeded your historical dataset, you can then create a scheduled export to continue populating your cost data in Azure storage as your charges accrue over time.
92
+
We recommend creating one-time data exports in one month chunks. If you want to seed a one-year historical dataset, then you should execute 12 Exports API requests - one for each month. After you seed your historical dataset, you can then create a scheduled export to continue populating your cost data in Azure storage as your charges accrue over time.
93
93
94
94
## Run each Export
95
95
96
-
Now that you have created the Export for each month, you need to manually run each by calling the [Execute API](/rest/api/cost-management/exports/execute). An example request to the API is below.
96
+
Now that you created the Export for each month, you need to manually run each by calling the [Execute](/rest/api/cost-management/exports/execute) API. Here's an example request to the API.
97
97
98
98
```http
99
99
POST https://management.azure.com/{scope}/providers/Microsoft.CostManagement/exports/{exportName}/run?api-version=2021-10-01
@@ -47,7 +47,7 @@ Here's an example of the application registration page.
47
47
48
48
You need the service principal's object ID and the tenant ID. You need this information for permission assignment operations later in this article. All applications are registered in Microsoft Entra ID in the tenant. Two types of objects get created when the app registration is completed:
49
49
50
-
- Application object - The application ID is what you see under Enterprise Applications. The ID should *not* be used to grant any EA roles.
50
+
- Application object - The application ID is what you see under Enterprise Applications. *Don't* use the ID to grant any EA roles.
51
51
- Service Principal object - The Service Principal object is what you see in the Enterprise Registration window in Microsoft Entra ID. The object ID is used to grant EA roles to the service principal.
52
52
53
53
1. Open Microsoft Entra ID, and then select **Enterprise applications**.
@@ -68,19 +68,19 @@ You need the service principal's object ID and the tenant ID. You need this info
68
68
69
69
## Permissions that can be assigned to the service principal
70
70
71
-
Later in this article, you'll give permission to the Microsoft Entra app to act by using an EA role. You can assign only the following roles to the service principal, and you need the role definition ID, exactly as shown.
71
+
Later in this article, you give permission to the Microsoft Entra app to act by using an EA role. You can assign only the following roles to the service principal, and you need the role definition ID, exactly as shown.
72
72
73
73
| Role | Actions allowed | Role definition ID |
74
74
| --- | --- | --- |
75
75
| EnrollmentReader | Enrollment readers can view data at the enrollment, department, and account scopes. The data contains charges for all of the subscriptions under the scopes, including across tenants. Can view the Azure Prepayment (previously called monetary commitment) balance associated with the enrollment. | 24f8edb6-1668-4659-b5e2-40bb5f3a7d7e |
76
-
| EA purchaser | Purchase reservation orders and view reservation transactions. It has all the permissions of EnrollmentReader, which will in turn have all the permissions of DepartmentReader. It can view usage and charges across all accounts and subscriptions. Can view the Azure Prepayment (previously called monetary commitment) balance associated with the enrollment. | da6647fb-7651-49ee-be91-c43c4877f0c4 |
76
+
| EA purchaser | Purchase reservation orders and view reservation transactions. It has all the permissions of EnrollmentReader, which have all the permissions of DepartmentReader. It can view usage and charges across all accounts and subscriptions. Can view the Azure Prepayment (previously called monetary commitment) balance associated with the enrollment. | da6647fb-7651-49ee-be91-c43c4877f0c4 |
77
77
| DepartmentReader | Download the usage details for the department they administer. Can view the usage and charges associated with their department. | db609904-a47f-4794-9be8-9bd86fbffd8a |
78
78
| SubscriptionCreator | Create new subscriptions in the given scope of Account. | a0bcee42-bf30-4d1b-926a-48d21664ef71 |
79
79
80
-
- An EnrollmentReader role can be assigned to a service principal only by a user who has an enrollment writer role. The EnrollmentReader role assigned to a service principal isn't shown in the Azure portal. It's created by programmatic means and is only for programmatic use.
80
+
- An EnrollmentReader role can be assigned to a service principal only by a user who has an enrollment writer role. The EnrollmentReader role assigned to a service principal isn't shown in the Azure portal. It gets created by programmatic means and is only for programmatic use.
81
81
- A DepartmentReader role can be assigned to a service principal only by a user who has an enrollment writer or department writer role.
82
-
- A SubscriptionCreator role can be assigned to a service principal only by a user who is the owner of the enrollment account (EA administrator). The role isn't shown in the Azure portal. It's created by programmatic means and is only for programmatic use.
83
-
- The EA purchaser role isn't shown in the Azure portal. It's created by programmatic means and is only for programmatic use.
82
+
- A SubscriptionCreator role can be assigned to a service principal only by a user who is the owner of the enrollment account (EA administrator). The role isn't shown in the Azure portal. It gets created by programmatic means and is only for programmatic use.
83
+
- The EA purchaser role isn't shown in the Azure portal. It gets created by programmatic means and is only for programmatic use.
84
84
85
85
When you grant an EA role to a service principal, you must use the `billingRoleAssignmentName` required property. The parameter is a unique GUID that you must provide. You can generate a GUID using the [New-Guid](/powershell/module/microsoft.powershell.utility/new-guid) PowerShell command. You can also use the [Online GUID / UUID Generator](https://guidgenerator.com/) website to generate a unique GUID.
86
86
@@ -108,7 +108,7 @@ A service principal can have only one role.
108
108
109
109
| Parameter | Where to find it |
110
110
| --- | --- |
111
-
|`properties.principalId`| It is the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
111
+
|`properties.principalId`| It's the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
112
112
|`properties.principalTenantId`| See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
@@ -118,7 +118,7 @@ A service principal can have only one role.
118
118
119
119
1. Select **Run** to start the command.
120
120
121
-
:::image type="content" source="./media/assign-roles-azure-service-principals/roleassignments-put-try-it-run.png" alt-text="Screenshot showing a example role assignment with example information that is ready to run." lightbox="./media/assign-roles-azure-service-principals/roleassignments-put-try-it-run.png" :::
121
+
:::image type="content" source="./media/assign-roles-azure-service-principals/roleassignments-put-try-it-run.png" alt-text="Screenshot showing an example role assignment with example information that is ready to run." lightbox="./media/assign-roles-azure-service-principals/roleassignments-put-try-it-run.png" :::
122
122
123
123
A `200 OK` response shows that the service principal was successfully added.
124
124
@@ -158,7 +158,7 @@ For the EA purchaser role, use the same steps for the enrollment reader. Specify
158
158
159
159
| Parameter | Where to find it |
160
160
| --- | --- |
161
-
|`properties.principalId`| It is the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
161
+
|`properties.principalId`| It's the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
162
162
|`properties.principalTenantId`| See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
@@ -192,7 +192,7 @@ Now you can use the service principal to automatically access EA APIs. The servi
192
192
193
193
-`enrollmentAccountName`: This parameter is the account **ID**. Find the account ID for the account name in the Azure portal on the **Cost Management + Billing** page.
194
194
195
-
For this example, we used the GTM Test Account. The ID is `196987`.
195
+
For this example, we used the `GTM Test Account`. The ID is `196987`.
196
196
197
197
:::image type="content" source="./media/assign-roles-azure-service-principals/account-id.png" alt-text="Screenshot showing the account ID." lightbox="./media/assign-roles-azure-service-principals/account-id.png" :::
198
198
@@ -202,7 +202,7 @@ Now you can use the service principal to automatically access EA APIs. The servi
202
202
203
203
| Parameter | Where to find it |
204
204
| --- | --- |
205
-
|`properties.principalId`| It is the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
205
+
|`properties.principalId`| It's the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
206
206
|`properties.principalTenantId`| See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
@@ -214,19 +214,19 @@ Now you can use the service principal to automatically access EA APIs. The servi
214
214
215
215
:::image type="content" source="./media/assign-roles-azure-service-principals/enrollment-account-role-assignments-put-try-it.png" alt-text="Screenshot showing the Try It option in the Enrollment Account Role Assignments - Put article." lightbox="./media/assign-roles-azure-service-principals/enrollment-account-role-assignments-put-try-it.png" :::
216
216
217
-
A `200 OK` response shows that the service principal has been successfully added.
217
+
A `200 OK` response shows that the service principal was successfully added.
218
218
219
219
Now you can use the service principal to automatically access EA APIs. The service principal has the SubscriptionCreator role.
220
220
221
221
## Verify service principal role assignments
222
222
223
-
Service principal role assignments are not visible in the Azure portal. You can view enrollment account role assignments, including the subscription creator role, with the [Billing Role Assignments - List By Enrollment Account - REST API (Azure Billing)](/rest/api/billing/2019-10-01-preview/billing-role-assignments/list-by-enrollment-account) API. Use the API to verify that the role assignment was successful.
223
+
Service principal role assignments aren't visible in the Azure portal. You can view enrollment account role assignments, including the subscription creator role, with the [Billing Role Assignments - List By Enrollment Account - REST API (Azure Billing)](/rest/api/billing/2019-10-01-preview/billing-role-assignments/list-by-enrollment-account) API. Use the API to verify that the role assignment was successful.
224
224
225
225
## Troubleshoot
226
226
227
-
You must identify and use the Enterprise application object ID where you granted the EA role. If you use the Object ID from some other application, API calls will fail. Verify that you’re using the correct Enterprise application object ID.
227
+
You must identify and use the Enterprise application object ID where you granted the EA role. If you use the Object ID from some other application, API calls fail. Verify that you’re using the correct Enterprise application object ID.
228
228
229
-
If you receive the following error when making your API call, then you may be incorrectly using the service principal object ID value located in App Registrations. To resolve this error, ensure you're using the service principal object ID from Enterprise Applications, not App Registrations.
229
+
If you receive the following error when making your API call, then you might be incorrectly using the service principal object ID value located in App Registrations. To resolve this error, ensure you're using the service principal object ID from Enterprise Applications, not App Registrations.
230
230
231
231
`The provided principal Tenant Id = xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx and principal Object Id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx are not valid`
0 commit comments