# Azure Cloud Cost Optimization — Connect Microsoft Azure to ZopNight

> Connect an Azure subscription or entire tenant. ZopNight discovers 85+ resource types including Azure OpenAI and Databricks, and schedules VMs, AKS, SQL and Flexible Servers off-hours.

Source: https://zop.dev/integrations/azure
Updated: 2026-08-20

---

## Common questions

### Does ZopNight need Contributor on my subscription?

No, and it never asks for Contributor or Owner. Discovery needs the built-in Reader and Cost Management Reader roles. Acting on findings adds two least-privilege custom roles the setup guide generates for you: Zopnight Write Access, and Zopnight AKS Access in place of the privileged built-in AKS cluster admin role.

### Can I connect a whole tenant instead of one subscription at a time?

Yes. Assign the roles once at the Tenant Root Group and pick tenant scope, and ZopNight discovers every subscription under it automatically. Subscription scope is the alternative if you want the blast radius bounded to one.

### Why does ZopNight deallocate a VM rather than shut it down?

A VM stopped from inside the guest OS stays allocated, and an allocated VM keeps billing for compute. ZopNight issues Microsoft.Compute/virtualMachines/deallocate/action, which releases the capacity and stops the charge. Disks bill either way, which is a separate finding.

ZopNight connects to Azure with a service principal or fully secret-less Workload Identity Federation, at subscription scope or across your whole tenant. It discovers more than 85 resource types through Azure Resource Graph, imports Cost Management billing, and safely stops idle infrastructure with tier-aware guardrails built in. AI coverage is the deepest in the industry, spanning Azure OpenAI deployments, AI Foundry, Azure ML and Databricks.

## Two custom roles, and subscription versus tenant scope

Create an app registration and either issue a client secret or, for the secret-less path, add a federated credential trusting ZopNight's Google-issued identity. Assign the built-in Reader and Cost Management Reader roles, plus two least-privilege custom roles generated by the setup guide for your chosen access level: Zopnight Write Access and Zopnight AKS Access (which replaces the privileged built-in AKS RBAC Cluster Admin role). Choose subscription scope, or tenant scope to assign roles once at the Tenant Root Group and let ZopNight discover every subscription automatically. Discovery runs through Azure Resource Graph every six hours with specialized enrichers for Azure ML, AI Foundry, Azure OpenAI data-plane objects and AI Search; metrics come from Azure Monitor with a 60-day lookback; costs from the Cost Management API; change history from Activity Logs plus Resource Graph change records with field-level before/after values.

## Entra ID steps, from app registration to scope

1. Create an app registration in Microsoft Entra ID.
2. Add a client secret, or a federated credential (Issuer: https://accounts.google.com, Subject: ZopNight's service identity) for secret-less auth.
3. Run the generated script or portal steps to create the two custom roles and assign Reader + Cost Management Reader.
4. In ZopNight, enter Tenant ID, Client ID, and (secret path only) the client secret, then pick subscription or tenant scope.
5. (Optional) Grant Microsoft Graph User.ReadBasic.All for ownership attribution.
6. (Optional, per Databricks workspace) Add the service principal to the workspace admins group.

## What a subscription scan turns up, and what it is judged against

Resource Graph discovery of 85+ types: VMs, VMSS, AKS, App Service, Functions, Container Apps, SQL family, Flexible Servers, Cosmos DB, Redis, Synapse, Data Factory, Data Explorer, Event Hubs, Service Bus, Storage, plus Azure ML, Azure OpenAI, AI Foundry, AI Search and Databricks. Cost Management billing with reservation-aware aggregation. Azure Monitor metrics, 60-day lookback. Scheduling for 16 resource types with tier-aware guardrails. 103 recommendation rules including rightsizing, Spot, Hybrid Benefit, reserved capacity, Azure OpenAI PTU utilization and Databricks pool/cluster hygiene. Field-level change tracking.