## Manual CLI Setup Some enterprise Azure tenants enforce security policies that block Global Admin consent for OAuth-based third-party application provisioning. This page covers the CLI/RBAC onboarding path — Archera's alternative for restricted tenants. Instead of the standard OAuth authorization screen, a privileged admin in your organization downloads a pre-generated bash script from the Archera platform and runs it in Azure Cloud Shell or a local terminal. The script applies the required RBAC role assignments directly — no user-impersonation consent required. > **Note:** This path must be enabled for your organization by Archera support before you begin. If you haven't already confirmed this with your Archera contact, email support@archera.ai. --- ### Prerequisites - An eligible Azure billing account type (Microsoft Customer Agreement, Microsoft Partner Agreement, or Enterprise Agreement). See Supported Account / Subscription Types. - The person running the script must have **Owner** or **User Access Administrator** on the target subscriptions. - **Access management for Azure resources** enabled in Microsoft Entra ID — required to create custom roles at tenant scope. See the Prerequisite Checklist. - Access to Azure Cloud Shell or a local terminal with the Azure CLI installed. --- ### Choosing Your Environment Azure Cloud Shell (recommended) Local Azure CLI Cloud Shell runs in your browser inside the Azure Portal and is pre-authenticated — no `az login` required. 1. Open the [Azure Portal](https://portal.azure.com/) 2. Click the **Cloud Shell** icon (`>_`) in the top navigation bar 3. Select **Bash** when prompted 4. Proceed to Download and Run the Script If running locally: 1. Install the [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) 2. Sign in to the correct tenant: `az login --tenant ` 3. Proceed to Download and Run the Script --- ### Download and Run the Script #### Step 1 — Select the CLI/RBAC path in the onboarding wizard When you reach the authorization step in the Archera onboarding flow, you will see two options: - **Standard OAuth** — for tenants without Global Admin consent restrictions - **CLI/RBAC script** — for restricted tenants Select **CLI/RBAC script**. #### Step 2 — Download the generated script Archera generates a bash script pre-populated with your organization's tenant ID, subscription IDs, and Archera's service principal. Download it from the onboarding screen. #### Step 3 — Run the script The platform provides run instructions for both environments: **Azure Cloud Shell (recommended)** 1. Launch [Cloud Shell](https://shell.azure.com/) in Bash mode 2. Upload the script via **Manage files → Upload** 3. Run: `bash archera-azure-onboarding.sh` **Local terminal** 1. Ensure the Azure CLI is installed: `az --version` 2. Log in to the correct tenant: `az login --tenant ` 3. Run: `bash .sh` **The script will:** 1. Validate your Azure session and target subscriptions 2. Register the required resource providers 3. Create the Archera custom RBAC role at tenant scope 4. Assign the required built-in roles to Archera's service principal 5. Create the resource group and storage account for cost exports 6. Print a completion summary You will be asked to confirm before any resources are created. #### Step 4 — Verify completion Once the script finishes, return to the Archera platform. The onboarding wizard detects that the required permissions have been applied and advances automatically. Expected state after a successful run: - No outstanding permission errors in the wizard - Green confirmation state on the authorization step If the wizard does not advance, refresh the page and allow **2–3 minutes** for Azure RBAC propagation before retrying. --- ### Role Summary The script assigns the following permissions to Archera's service principal: | Role | Scope | Purpose | |-------------------------------|---------------------------------------|-----------------------------------------------------------| | Archera Custom Role (read) | Each selected subscription | Billing, cost management, resource reads | | Reader and Data Access | Storage account | SAS token generation for cost export reads | | Storage Blob Data Reader | Storage account | Direct blob read access | | User Access Administrator | Storage account | Grant write access to Cost Management export managed identity| | Reservation Reader | `/providers/Microsoft.Capacity` | Read existing Reserved Instances | | Reservation Purchaser | `/providers/Microsoft.Capacity` + management subscription | Purchase Reserved Instances | | Savings Plan Reader | `/providers/Microsoft.BillingBenefits`| Read existing Savings Plans | | Savings Plan Purchaser | `/providers/Microsoft.BillingBenefits` + management subscription | Purchase Savings Plans | | Advisor Recommendations Contributor | `/providers/Microsoft.Advisor` | Read Advisor recommendations | --- ### Troubleshooting **Script exits with a permissions error** The user running the script lacks sufficient rights to assign RBAC roles. Confirm the running account has **Owner** or **User Access Administrator** on the target subscriptions and that **Access management for Azure resources** is enabled in Microsoft Entra ID. **Wizard does not advance after the script completes** Allow 2–3 minutes for Azure RBAC propagation and refresh. If the issue persists, confirm the script ran against the correct subscriptions — a mismatch between the subscriptions Archera expects and what the script targeted is the most common cause. **CLI/RBAC option not visible in the onboarding wizard** This path requires a feature flag enabled by Archera on your account — it is not self-service. Contact your Archera representative or email support@archera.ai to request it before attempting onboarding. --- ### Related Resources - Azure Onboarding — Prerequisite Checklist - Azure Onboarding — Required Permissions - How Does Archera Access My Azure Environment? - Azure Offboarding