## Read Access

- [**Storage Blob Data Reader**](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-blob-data-reader) \- Read blob containers and blob data. Expected scope: the storage account that stores Azure cost exports.

- [**Billing Reader**](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/management-and-governance#billing-reader) \- Read billing data, invoices, and usage details. Expected scope: your Azure billing scope.

- [**Reservations Reader**](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/management-and-governance#reservations-reader) \- Read reservation data and related transactions. Expected scope: the tenant root group.

- [**Savings Plan Reader**](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/management-and-governance#savings-plan-reader) \- Read savings plan data and related transactions. Expected scope: the tenant root group.

## Write Access

- [**Reservation Purchaser**](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/management-and-governance#reservation-purchaser) \- Create reservations and read reservation transactions. Expected scope: the tenant root group.

- [**Savings Plan Purchaser**](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/management-and-governance#savings-plan-purchaser) \- Create savings plans and read savings plan transactions. Expected scope: the tenant root group.

## One-Time Write Access

We utilize the compressed cost export feature inside Azure that adheres to the FinOps Cost Usage and Specification (FOCUS) dataset standards. This feature requires a blob storage account, so we utilize a one-time write action to configure the cost export.

For more details, see: [Microsoft Cost Management updates — announcing the new FOCUS report](https://azure.microsoft.com/en-us/blog/announcing-the-new-finops-cost-usage-specification-report-now-in-public-preview-in-azure-cost-management/)

## Related Resources

- [Prerequisite Checklist](https://docs.archera.ai/help-center/azure-onboarding/technical-onboarding/prerequisite-checklist)

- [What Information Does Archera Require to Connect to My Azure Account?](https://docs.archera.ai/help-center/azure-onboarding/technical-onboarding/required-information)

- [How Does Archera Access My Azure Environment?](https://docs.archera.ai/help-center/security/azure-access)

- [Azure Offboarding](https://docs.archera.ai/help-center/azure-onboarding/offboarding)