Azure Cloud Cost Optimization — Connect Microsoft Azure to ZopNight

ZopNight connects to Azure with a service principal or fully secret-less Workload Identity Federation, at subscription scope or across your whole tenant. It discovers more than 85 resource types through Azure Resource Graph, imports Cost Management billing, and safely stops idle infrastructure with tier-aware guardrails built in. AI coverage is the deepest in the industry, spanning Azure OpenAI deployments, AI Foundry, Azure ML and Databricks.

Two custom roles, and subscription versus tenant scope

Create an app registration and either issue a client secret or, for the secret-less path, add a federated credential trusting ZopNight’s Google-issued identity. Assign the built-in Reader and Cost Management Reader roles, plus two least-privilege custom roles generated by the setup guide for your chosen access level: Zopnight Write Access and Zopnight AKS Access (which replaces the privileged built-in AKS RBAC Cluster Admin role). Choose subscription scope, or tenant scope to assign roles once at the Tenant Root Group and let ZopNight discover every subscription automatically. Discovery runs through Azure Resource Graph every six hours with specialized enrichers for Azure ML, AI Foundry, Azure OpenAI data-plane objects and AI Search; metrics come from Azure Monitor with a 60-day lookback; costs from the Cost Management API; change history from Activity Logs plus Resource Graph change records with field-level before/after values.

Entra ID steps, from app registration to scope

1. Create an app registration in Microsoft Entra ID.
2. Add a client secret, or a federated credential (Issuer: https://accounts.google.com, Subject: ZopNight’s service identity) for secret-less auth.
3. Run the generated script or portal steps to create the two custom roles and assign Reader + Cost Management Reader.
4. In ZopNight, enter Tenant ID, Client ID, and (secret path only) the client secret, then pick subscription or tenant scope.
5. (Optional) Grant Microsoft Graph User.ReadBasic.All for ownership attribution.
6. (Optional, per Databricks workspace) Add the service principal to the workspace admins group.

What a subscription scan turns up, and what it is judged against

Resource Graph discovery of 85+ types: VMs, VMSS, AKS, App Service, Functions, Container Apps, SQL family, Flexible Servers, Cosmos DB, Redis, Synapse, Data Factory, Data Explorer, Event Hubs, Service Bus, Storage, plus Azure ML, Azure OpenAI, AI Foundry, AI Search and Databricks. Cost Management billing with reservation-aware aggregation. Azure Monitor metrics, 60-day lookback. Scheduling for 16 resource types with tier-aware guardrails. 103 recommendation rules including rightsizing, Spot, Hybrid Benefit, reserved capacity, Azure OpenAI PTU utilization and Databricks pool/cluster hygiene. Field-level change tracking.