Skip to content

Commit cee8aa2

Browse files
committed
acrolinx and link fixes
1 parent 5e63936 commit cee8aa2

File tree

3 files changed

+67
-66
lines changed

3 files changed

+67
-66
lines changed

articles/cost-management-billing/automate/tutorial-seed-historical-cost-dataset-exports-api.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ms.reviewer: jojoh
1212

1313
# Tutorial: Seed a historical cost dataset with the Exports API
1414

15-
Large organizations often need to analyze their historical costs going back a year or more. Creating the dataset might be needed for targeted one-time inquiries or to set up reporting dashboards to visualize cost trends over time. In either case, you need a way to get the data reliably so that you can load it into a data store that you can query. After your historical cost dataset is seeded, your data store can then be updated as new costs come in so that your reporting is kept up to date. Historical costs rarely change and if so, you'll be notified. So we recommend that you refresh your historical costs no more than once a month.
15+
Large organizations often need to analyze their historical costs going back a year or more. Creating the dataset might be needed for targeted one-time inquiries or to set up reporting dashboards to visualize cost trends over time. In either case, you need a way to get the data reliably so that you can load it into a data store that you can query. After your historical cost dataset is seeded, your data store can then be updated as new costs come in so that your reporting is kept up to date. Historical costs rarely change and if so, you get notified. So we recommend that you refresh your historical costs no more than once a month.
1616

1717
In this tutorial, you learn how to:
1818

@@ -28,9 +28,9 @@ You need proper permissions to successfully call the Exports API. We recommend u
2828
- To learn more, see [Assign permissions to Cost Management APIs](cost-management-api-permissions.md).
2929
- To learn more about the specific permissions needed for the Exports API, see [Understand and work with scopes](../costs/understand-work-scopes.md).
3030

31-
Additionally, you'll need a way to query the API directly. Some popular ways to query the API are:
31+
Additionally, you need a way to query the API directly. Some popular ways to query the API are:
3232

33-
- [Visual studio](https://learn.microsoft.com/aspnet/core/test/http-files)
33+
- [Visual studio](/aspnet/core/test/http-files)
3434
- [Insomnia](https://insomnia.rest/)
3535
- [Bruno](https://www.usebruno.com/)
3636
- PowerShell’s [Invoke-RestMethod](https://powershellcookbook.com/recipe/Vlhv/interact-with-rest-based-web-apis)
@@ -89,11 +89,11 @@ Content-Type: application/json
8989

9090
## Create Exports in one-month chunks
9191

92-
We recommend creating one-time data exports in one month chunks. If you want to seed a one-year historical dataset, then you should execute 12 Exports API requests - one for each month. After you've seeded your historical dataset, you can then create a scheduled export to continue populating your cost data in Azure storage as your charges accrue over time.
92+
We recommend creating one-time data exports in one month chunks. If you want to seed a one-year historical dataset, then you should execute 12 Exports API requests - one for each month. After you seed your historical dataset, you can then create a scheduled export to continue populating your cost data in Azure storage as your charges accrue over time.
9393

9494
## Run each Export
9595

96-
Now that you have created the Export for each month, you need to manually run each by calling the [Execute API](/rest/api/cost-management/exports/execute). An example request to the API is below.
96+
Now that you created the Export for each month, you need to manually run each by calling the [Execute](/rest/api/cost-management/exports/execute) API. Here's an example request to the API.
9797

9898
```http
9999
POST https://management.azure.com/{scope}/providers/Microsoft.CostManagement/exports/{exportName}/run?api-version=2021-10-01

articles/cost-management-billing/manage/assign-roles-azure-service-principals.md

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ Before you begin, ensure that you're familiar with the following articles:
2424

2525
You need a way to call REST APIs. Some popular ways to query the API are:
2626

27-
- [Visual studio](https://learn.microsoft.com/aspnet/core/test/http-files)
27+
- [Visual studio](/aspnet/core/test/http-files)
2828
- [Insomnia](https://insomnia.rest/)
2929
- [Bruno](https://www.usebruno.com/)
3030
- PowerShell’s [Invoke-RestMethod](https://powershellcookbook.com/recipe/Vlhv/interact-with-rest-based-web-apis)
@@ -47,7 +47,7 @@ Here's an example of the application registration page.
4747

4848
You need the service principal's object ID and the tenant ID. You need this information for permission assignment operations later in this article. All applications are registered in Microsoft Entra ID in the tenant. Two types of objects get created when the app registration is completed:
4949

50-
- Application object - The application ID is what you see under Enterprise Applications. The ID should *not* be used to grant any EA roles.
50+
- Application object - The application ID is what you see under Enterprise Applications. *Don't* use the ID to grant any EA roles.
5151
- Service Principal object - The Service Principal object is what you see in the Enterprise Registration window in Microsoft Entra ID. The object ID is used to grant EA roles to the service principal.
5252

5353
1. Open Microsoft Entra ID, and then select **Enterprise applications**.
@@ -68,19 +68,19 @@ You need the service principal's object ID and the tenant ID. You need this info
6868
6969
## Permissions that can be assigned to the service principal
7070

71-
Later in this article, you'll give permission to the Microsoft Entra app to act by using an EA role. You can assign only the following roles to the service principal, and you need the role definition ID, exactly as shown.
71+
Later in this article, you give permission to the Microsoft Entra app to act by using an EA role. You can assign only the following roles to the service principal, and you need the role definition ID, exactly as shown.
7272

7373
| Role | Actions allowed | Role definition ID |
7474
| --- | --- | --- |
7575
| EnrollmentReader | Enrollment readers can view data at the enrollment, department, and account scopes. The data contains charges for all of the subscriptions under the scopes, including across tenants. Can view the Azure Prepayment (previously called monetary commitment) balance associated with the enrollment. | 24f8edb6-1668-4659-b5e2-40bb5f3a7d7e |
76-
| EA purchaser | Purchase reservation orders and view reservation transactions. It has all the permissions of EnrollmentReader, which will in turn have all the permissions of DepartmentReader. It can view usage and charges across all accounts and subscriptions. Can view the Azure Prepayment (previously called monetary commitment) balance associated with the enrollment. | da6647fb-7651-49ee-be91-c43c4877f0c4 |
76+
| EA purchaser | Purchase reservation orders and view reservation transactions. It has all the permissions of EnrollmentReader, which have all the permissions of DepartmentReader. It can view usage and charges across all accounts and subscriptions. Can view the Azure Prepayment (previously called monetary commitment) balance associated with the enrollment. | da6647fb-7651-49ee-be91-c43c4877f0c4 |
7777
| DepartmentReader | Download the usage details for the department they administer. Can view the usage and charges associated with their department. | db609904-a47f-4794-9be8-9bd86fbffd8a |
7878
| SubscriptionCreator | Create new subscriptions in the given scope of Account. | a0bcee42-bf30-4d1b-926a-48d21664ef71 |
7979

80-
- An EnrollmentReader role can be assigned to a service principal only by a user who has an enrollment writer role. The EnrollmentReader role assigned to a service principal isn't shown in the Azure portal. It's created by programmatic means and is only for programmatic use.
80+
- An EnrollmentReader role can be assigned to a service principal only by a user who has an enrollment writer role. The EnrollmentReader role assigned to a service principal isn't shown in the Azure portal. It gets created by programmatic means and is only for programmatic use.
8181
- A DepartmentReader role can be assigned to a service principal only by a user who has an enrollment writer or department writer role.
82-
- A SubscriptionCreator role can be assigned to a service principal only by a user who is the owner of the enrollment account (EA administrator). The role isn't shown in the Azure portal. It's created by programmatic means and is only for programmatic use.
83-
- The EA purchaser role isn't shown in the Azure portal. It's created by programmatic means and is only for programmatic use.
82+
- A SubscriptionCreator role can be assigned to a service principal only by a user who is the owner of the enrollment account (EA administrator). The role isn't shown in the Azure portal. It gets created by programmatic means and is only for programmatic use.
83+
- The EA purchaser role isn't shown in the Azure portal. It gets created by programmatic means and is only for programmatic use.
8484

8585
When you grant an EA role to a service principal, you must use the `billingRoleAssignmentName` required property. The parameter is a unique GUID that you must provide. You can generate a GUID using the [New-Guid](/powershell/module/microsoft.powershell.utility/new-guid) PowerShell command. You can also use the [Online GUID / UUID Generator](https://guidgenerator.com/) website to generate a unique GUID.
8686

@@ -108,7 +108,7 @@ A service principal can have only one role.
108108

109109
| Parameter | Where to find it |
110110
| --- | --- |
111-
| `properties.principalId` | It is the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
111+
| `properties.principalId` | It's the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
112112
| `properties.principalTenantId` | See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
113113
| `properties.roleDefinitionId` | `/providers/Microsoft.Billing/billingAccounts/{BillingAccountName}/billingRoleDefinitions/24f8edb6-1668-4659-b5e2-40bb5f3a7d7e` |
114114

@@ -118,7 +118,7 @@ A service principal can have only one role.
118118

119119
1. Select **Run** to start the command.
120120

121-
:::image type="content" source="./media/assign-roles-azure-service-principals/roleassignments-put-try-it-run.png" alt-text="Screenshot showing a example role assignment with example information that is ready to run." lightbox="./media/assign-roles-azure-service-principals/roleassignments-put-try-it-run.png" :::
121+
:::image type="content" source="./media/assign-roles-azure-service-principals/roleassignments-put-try-it-run.png" alt-text="Screenshot showing an example role assignment with example information that is ready to run." lightbox="./media/assign-roles-azure-service-principals/roleassignments-put-try-it-run.png" :::
122122

123123
A `200 OK` response shows that the service principal was successfully added.
124124

@@ -158,7 +158,7 @@ For the EA purchaser role, use the same steps for the enrollment reader. Specify
158158

159159
| Parameter | Where to find it |
160160
| --- | --- |
161-
| `properties.principalId` | It is the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
161+
| `properties.principalId` | It's the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
162162
| `properties.principalTenantId` | See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
163163
| `properties.roleDefinitionId` | `/providers/Microsoft.Billing/billingAccounts/{BillingAccountName}/billingRoleDefinitions/db609904-a47f-4794-9be8-9bd86fbffd8a` |
164164

@@ -192,7 +192,7 @@ Now you can use the service principal to automatically access EA APIs. The servi
192192

193193
- `enrollmentAccountName`: This parameter is the account **ID**. Find the account ID for the account name in the Azure portal on the **Cost Management + Billing** page.
194194

195-
For this example, we used the GTM Test Account. The ID is `196987`.
195+
For this example, we used the `GTM Test Account`. The ID is `196987`.
196196

197197
:::image type="content" source="./media/assign-roles-azure-service-principals/account-id.png" alt-text="Screenshot showing the account ID." lightbox="./media/assign-roles-azure-service-principals/account-id.png" :::
198198

@@ -202,7 +202,7 @@ Now you can use the service principal to automatically access EA APIs. The servi
202202

203203
| Parameter | Where to find it |
204204
| --- | --- |
205-
| `properties.principalId` | It is the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
205+
| `properties.principalId` | It's the value of Object ID. See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
206206
| `properties.principalTenantId` | See [Find your service principal and tenant IDs](#find-your-service-principal-and-tenant-ids). |
207207
| `properties.roleDefinitionId` | `/providers/Microsoft.Billing/billingAccounts/{BillingAccountID}/enrollmentAccounts/{enrollmentAccountID}/billingRoleDefinitions/a0bcee42-bf30-4d1b-926a-48d21664ef71` |
208208

@@ -214,19 +214,19 @@ Now you can use the service principal to automatically access EA APIs. The servi
214214

215215
:::image type="content" source="./media/assign-roles-azure-service-principals/enrollment-account-role-assignments-put-try-it.png" alt-text="Screenshot showing the Try It option in the Enrollment Account Role Assignments - Put article." lightbox="./media/assign-roles-azure-service-principals/enrollment-account-role-assignments-put-try-it.png" :::
216216

217-
A `200 OK` response shows that the service principal has been successfully added.
217+
A `200 OK` response shows that the service principal was successfully added.
218218

219219
Now you can use the service principal to automatically access EA APIs. The service principal has the SubscriptionCreator role.
220220

221221
## Verify service principal role assignments
222222

223-
Service principal role assignments are not visible in the Azure portal. You can view enrollment account role assignments, including the subscription creator role, with the [Billing Role Assignments - List By Enrollment Account - REST API (Azure Billing)](/rest/api/billing/2019-10-01-preview/billing-role-assignments/list-by-enrollment-account) API. Use the API to verify that the role assignment was successful.
223+
Service principal role assignments aren't visible in the Azure portal. You can view enrollment account role assignments, including the subscription creator role, with the [Billing Role Assignments - List By Enrollment Account - REST API (Azure Billing)](/rest/api/billing/2019-10-01-preview/billing-role-assignments/list-by-enrollment-account) API. Use the API to verify that the role assignment was successful.
224224

225225
## Troubleshoot
226226

227-
You must identify and use the Enterprise application object ID where you granted the EA role. If you use the Object ID from some other application, API calls will fail. Verify that you’re using the correct Enterprise application object ID.
227+
You must identify and use the Enterprise application object ID where you granted the EA role. If you use the Object ID from some other application, API calls fail. Verify that you’re using the correct Enterprise application object ID.
228228

229-
If you receive the following error when making your API call, then you may be incorrectly using the service principal object ID value located in App Registrations. To resolve this error, ensure you're using the service principal object ID from Enterprise Applications, not App Registrations.
229+
If you receive the following error when making your API call, then you might be incorrectly using the service principal object ID value located in App Registrations. To resolve this error, ensure you're using the service principal object ID from Enterprise Applications, not App Registrations.
230230

231231
`The provided principal Tenant Id = xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx and principal Object Id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx are not valid`
232232

0 commit comments

Comments
 (0)