# Azure Onboarding Prerequisite Checklist

Azure onboarding requires two checks before you begin.

## 1. User Access Administrator role at root scope

Archera creates a custom RBAC role inside your Azure tenant. Make sure your onboarding user has `Access management for Azure resources` enabled. This is a **hard requirement BEFORE** beginning Archera's Azure onboarding. If you don't verify or action this step, the onboarding will fail.

**NOTE:** The "onboarding user" will be whoever from your company executes the Archera onboarding process.

We are **NOT** asking for you to grant Archera these permissions. We are ensuring your personnel has sufficient permissions in your environment to complete the process.

### Global Administrator + Entra properties toggle on

1. Go to **Microsoft Entra ID** → **Users**.
2. Select the onboarding user.
3. Open **Assigned roles**.
4. Add `Global Administrator` in the role directory.
5. Go to **Microsoft Entra ID** → **Overview** → **Properties**.
6. Turn on `Access management for Azure resources` if it is off.
7. Click **Save** to apply.

You can find this setting in: `Microsoft Entra ID > Overview > Properties`. This toggle only needs to be enabled for your personnel for the duration of onboarding. You can disable it after onboarding completes.

## 2. Contributor role at subscription scope

Your designated "onboarding user" needs `Contributor` RBAC role at subscription scope.

**NOTE:** The "onboarding user" will be whoever from your company executes the Archera onboarding process. We are **NOT** asking for you to grant Archera these permissions. We are ensuring your personnel has sufficient permissions in your environment to complete the process.

This contributor access is only required for the single subscription as detailed below.

- When you provide your Azure Tenant ID and Subscription ID in the first stage of onboarding flow, this subscription will house a `Resource Group` and `Storage Account` to store Cost Exports.
  - Microsoft requires Cost Exports to live in a storage account in your own Azure estate.
  - We create those resources on your behalf later in the onboarding flow. In order to facilitate that, we need the contributor access to just the one sub.

Yes, you can onboard more than one subscription at a time. We just need one of your subs earmarked to hold the cost exports for all of the subscriptions you choose to onboard into Archera.

## Related Resources

- [Azure Onboarding - Supported Account / Subscription Types](https://docs.archera.ai/help-center/azure-onboarding/technical-onboarding/supported-account-types)
- [Azure Onboarding - Required Permissions](https://docs.archera.ai/help-center/azure-onboarding/technical-onboarding/required-permissions)
- [Does Archera for Azure rely on Microsoft Azure Exchanges or Returns policy?](https://docs.archera.ai/help-center/azure-onboarding/other-faq/exchanges-returns-policy)
- [Does Archera Support Reservations for Azure Storage Disks?](https://docs.archera.ai/help-center/azure-onboarding/services-supported/storage-disks)
- [Azure Offboarding](https://docs.archera.ai/help-center/azure-onboarding/offboarding/offboarding)