Setting up Azure Account

Depending on the type, you can configure Tanzu CloudHealth to populate complete cost and usage information for your Microsoft Azure account.

Enterprise Agreement Azure Account

Register Tanzu CloudHealth App with Service Principal
Assign an Enrollment Reader Role to the Service Principal
Add Reader Role for Subscriptions
Connect Service Principal in Tanzu CloudHealth
Get Commitment Start Date and Commitment Amount
Connect Enrollment in Tanzu CloudHealth
Assign Reader Role to Azure Reservation Orders
Assign Reader Role to Azure Savings Plan
Configure Application Permission for Azure AD User Collection (optional)

For detailed instructions, refer to the Configuring an Enterprise Agreement Azure Account section below.

Pay-as-you-go Azure Account

Register Tanzu CloudHealth with Service Principal
Add Reader role for Subscriptions
Connect Service Principal
Assign a Reader Role to Azure Reservation Orders
Configure Application Permission for Azure AD User Collection

For detailed instructions, refer to the Configuring a Pay-as-you-go Azure Account section below.

Microsoft Customer Agreement

Register Tanzu CloudHealth with Service Principal
Add Reader Role for Subscriptions
Add Service Principal as the Billing Account Reader
Connect Service Principal
Assign a Reader Role to Azure Reservation Orders
Configure Application Permission for Azure AD User Collection

For detailed instructions, refer to the Configuring Microsoft Customer Agreement section below.

Roles and Permissions for Azure

Assigning the required Azure IAM permissions to your custom role is essential to

Implement actions from the policy- From the left menu, go to Setup > Governance > Policy. When creating or updating a policy, select the required policy action from the dropdown.
Implement bulk actions on assets- From the left menu, go to Assets > Azure, and select the required asset. On the asset report page, select the resources. From the Bulk Actions dropdown, select the required action for the selected resources.
Implement custom action on an asset- From the left menu, go to Assets > Azure, and select the required asset. On the asset report page, move the horizontal scroll bar to the right end to view the Actions column. Select the required action from the Actions dropdown.

You can use an existing custom role and add permissions to it, or if you want, you can create a new custom role. For steps on how to create a custom role, see Azure custom roles.

You must have Owner or User Access Administrator access to create or assign roles.

Required Azure IAM Permissions

For Azure Managed Disks

Field	Description
Required IAM Permissions	`Microsoft.Compute/disks/delete` - Delete a managed disk.
Tanzu CloudHealth reports associated with the resource	Azure Disk Assets report
Collection Frequency	Every 15 min

For Azure Snapshots

Field	Description
Required IAM Permissions	`Microsoft.Compute/snapshots/delete` - Delete a snapshot.
	`Microsoft.Compute/snapshots/write` - Take Snapshot of your Azure Disk.
Tanzu CloudHealth reports associated with the resource	Azure Snapshot Assets report
Collection Frequency	Every 15 min

Note When you create a snapshot, you automatically create a snapshot name off the disk name. The format of new Snapshot name would be - disk_name-snapshot-UUID.

For Azure IP Addresses

Field	Description
Required IAM Permissions	`Microsoft.Network/publicIPAddresses/delete` - Delete a public IP address
Tanzu CloudHealth reports associated with the resource	Azure IP Address Assets report
Collection Frequency	Every 15 min

Configuring an Enterprise Agreement Azure Account

Complete the following steps to configure your Enterprise Agreement (EA) Azure account with VMware Tanzu CloudHealth.

Step 1 - Register Tanzu CloudHealth App with Service Principal

Prerequisite: You must have global administrator privileges to register an App. While the connection between Tanzu CloudHealth and Azure is read-only, a global administrator must register the App to ensure that there are no errors.

In the Azure Portal, select Azure Active Directory from the left menu.
From the left menu, select App Registrations tile and then click New App Registration.
Fill out the following fields in the form and then click Create:
- Name: Enter the name of the service principal
- Supported Account Types: Select Accounts in this organizational directory only.
- Redirect URI: Select Web from the dropdown and enter https://apps.cloudhealthtech.com
Open the Application Registration you just created.
- Copy the Display Name into the text document.
- Copy the Application ID into the text document. Due to a rare issue in the Azure Portal, creating a new app registration might fail to create a new service principal as expected. If this occurs, click the Create Service Principal link in App Registrations > Overview.
Go to Certificates & Secrets in the left menu. Click New Client Secret.
- Add a key description. Make sure there are no spaces.
- Select a duration. It is recommended that you set the expiration to at least one year.
Click Save. A value is generated.
Copy the key description and value into the text document.
Close the App Registration blade and return to the Active Directory menu.
Under the Manage header, select Properties.
Locate the directory ID. Select the Copy icon to copy the ID and then paste it into the text document.
Repeat steps 1-10 for each directory you manage.

Checkpoint: At this point, you have this information in the text document.

Display Name
Application ID
Key Description
Key Value
Directory ID/Tenant ID

Step 2 - Assign an Enrollment Reader Role to the Service Principal

You can only create or update this billing role using the API.

Use your account credentials as an Enterprise Admin to sign in to the tenant with the enrollment access that you want to assign.
Provide the following parameters as a part of the API request. For help locating these values, see Find your SPN and tenant ID.
- Object ID
- Azure Tenant ID
- BillingAccountID
- Role definition (already pre-filled with correct role ID).

Example:

{
  "properties": {
    "principalId": "REPLACE WITH OBJECT ID",
    "principalTenantId": "REPLACE WITH TENANT ID",
    "roleDefinitionId": "/providers/Microsoft.Billing/billingAccounts/REPLACE WITH BillingAccountID/billingRoleDefinitions/24f8edb6-1668-4659-b5e2-40bb5f3a7d7e"
  }
}

Locate the enrollment ID of your active EA and the billing account name.
- The enrollment ID can be found in the EA and Azure portal.
- The billing account name is the same as the billingAccountID that you used in the API parameters.
Generate the GUID billingRoleAssignmentName. Generate a GUID using the New-Guid PowerShell command. You can also use the Online GUID / UUID Generator website to generate a unique GUID. Note down the GUID for later use.
Use the Role Assignments - Put - REST API (Azure Billing) command to update the role assignments.
Repeat the previous steps for other Service Principles.

Mapping Multiple Enrollments to the Same Service Principal

If you have multiple enrollments mapped to the same service principles, you will need to run the Role Assignments - Put - REST API (Azure Billing) command for each enrollment.

Open the Role Assignments - Put REST API article, and click Try it.
Sign in to the tenant as an Enterprise Admin with the enrollment access.
Provide the following parameters as a part of the API request.
- Object ID
- Azure Tenant ID
- Enrollment Id
- Role definition (already pre-filled with correct role ID)
For help on locating these values, see Find your SPN and tenant ID.

Example:
```
{
“properties”: {
“principalId”: “SPN ID OR OBJECT ID”,
“principalTenantId”: “ADtenant ID OR Azure Tenant ID”,
“roleDefinitionId”: “/providers/Microsoft.Billing/billingAccounts/EnrollmentID/billingRoleDefinitions/24f8edb6-1668-4659-b5e2-40bb5f3a7d7e”
}
}
```
- Change the EnrollmentID parameter in the request Body.
- Generate a new GUID using the New-Guid PowerShell command.
Click Run.
Repeat the previous steps for each enrollment.

Configuring GovCloud Subscriptions

When configuring the Service Principals with the enrollmentReader permission, change the API endpoint URL in the Role Assignments - Put API from https://management.azure.com to https://management.usgovcloudapi.net to grant the SPN the new permission.

Step 3 - Add Reader Role for Subscriptions

For help assigning roles in Azure, see Assign Azure Roles using the Azure Portal.

When assigning the role, make the following selections:

Role: Reader
Members: Select the Service Principal created in Step 1.

Repeat this step for each subscription.

Add Permissions to Access Key Vault (Optional)

With the additional get and list permissions, Tanzu CloudHealth gets access to keys and secrets for each key vault under each subscription. Providing this access offers the following benefits:

Visibility: Get all keys & secret details under each key vault in Asset reports.
Policies: Create policies on keys and secrets and get notified if any key/secret doesn’t have an expiry date set.
Perspectives: Since Key Vault Keys & Secrets are taggable assets, you can create perspective groups based on tags.

Use the following steps to grant additional permissions to the service principal:

Enter the following PowerShell script for every active Service Principal that you have added in Tanzu CloudHealth.

$subs = Get-AzureRmSubscription
$client_id = 'Application id of service principal'
foreach ($sub in $subs) {Set-AzureRmContext -SubscriptionId $sub.SubscriptionId
$key_vaults = Get-AzureRmKeyVault
foreach ($key_vault in $key_vaults) {Set-AzureRmKeyVaultAccessPolicy -VaultName $key_vault.VaultName -ServicePrincipalName $client_id -PermissionsToKeys get,list -PermissionsToSecrets get,list } }

Get the Application id of the service principal from Tanzu CloudHealth. Go to Setup > Accounts > Azure Service Principal.

The script accesses current key vaults and grant permission to the service principal to retrieve and display key vault keys and secrets.

For a newly-added key vault, you need to separately grant permission to the service principal to retrieve and display keys. You can either run the above PowerShell script or manually add the service principal using following steps:

In the Azure Portal, go to the newly added key vault.
From the Settings menu, navigate to Access Policies, and click Add Access Policy.
Select get, list permissions from the__ Key permissions__ and Secret permissions dropdown.
Select Service principal.
Click Add.

Step 4 - Connect Service Principal in Tanzu CloudHealth

Connect the Service Principal that you configured in the Azure portal to Tanzu CloudHealth.

Log in to the Tanzu CloudHealth platform. Navigate to select Setup > Accounts > Azure Service Principal. Then click New Service Principal.
Select Global Azure from the Account Type dropdown.
Copy the information from the text document into corresponding fields in the setup form. Make sure there are no spaces.
Optionally, select the Security Asset Collection dropdown if you want to disable asset collection on certain assets for security reasons. Tanzu CloudHealth recommends enabling asset collection for all assets and does not store sensitive data. Disabled assets are marked as inactive in Tanzu CloudHealth and cannot be used in policies.
Click Save Service Principal.

Step 5 - Get Commitment Start Date and Commitment Amount

Get the date when you Enterprise Agreement starts and how much money you have committed to the agreement.

Log in to the Azure portal.
Navigate to Cost Management + Billing, and select your Enterprise Agreement billing account.
From the left pane, select Credits + Commitments, then select the Microsoft Azure Consumption Commitment (MACC) tab.
Copy the commitment Start Date and Commitment Amount into a text document.

Step 6 - Connect Enrollment in Tanzu CloudHealth

Navigate to Setup > Accounts > Azure Enrollment.
Click Add Enrollment.
Enter the Enrollment ID and give your enrollment a friendly name (e.g., Company EA).
Select the required Service Principal from the dropdown.
In the Commitment section, select the Commitment Term.
Optionally, provide Commitment Amount and Commitment Start Date.
Click Save Enrollment.

Note - The API Access Key is not required to connect the enrollment.

Step 7 - Assign a Reader Role to Azure Reservation Orders

Assign a reader role to Azure reservation orders to enable Azure data in Tanzu CloudHealth reports. To allow Tanzu CloudHealth reader-only access to your reservations, you must assign a reader role to all your reservation orders. Failure to do so will prevent your Azure reports from working correctly.

Log in to the Azure Portal and go to Azure Active Directory > App Registrations.
Copy the display name of the application you registered for Tanzu CloudHealth and paste it in a Text file (such as NotePad or TextEdit).
Log in to Tanzu CloudHealth. Go to Assets > Azure and select Reservation Orders from the Other section.
For the first reservation order in the table, select the Azure Portal icon to open that reservation order in the Azure Portal.
Go to Access Control (IAM) and click Add.
Fill out the fields as follows:
- Select Reader from the Role dropdown menu.
- In the Select field, copy and paste the service principal display name from step 2 that is associated with the reservation order and select the user returned by the search.
Click Save.
Repeat steps 4-7 for each reservation order.

Step 8 - Assign a Reader Role to Azure Savings Plans

Log in to the Azure Portal and go to Azure Active Directory > App Registrations.
Copy the display name of the application you registered for Tanzu CloudHealth and paste it in a Text file (such as NotePad or TextEdit).
Log in to the Tanzu CloudHealth platform. Go to Assets > Azure and select Savings Plans from the Other section.
In the Savings Plan table, click the Go to Azure Portal icon to open the savings plan in the Azure portal.
From the left pane, go to Access Control (IAM) and click Add role assignment.
Fill out the fields as follows:
- Select Reader from the Role dropdown menu.
- In the Select field, copy and paste the service principal display name from step 2 that is associated with the savings plan and select the user returned by the search.
Click Save.
Repeat steps 4-7 for each Savings Plan.

Step 9 - Configure Application Permission for Azure AD User Collection (Optional)

Tanzu CloudHealth supports Azure AD User collection through Azure Service Principal. To collect the Azure AD objects, you need to add an additional Graph API permission to the Service Principal.

Log in to the Azure Portal, go to Azure Active Directory > App Registrations, and select the Tanzu CloudHealth app.
Click API permissions > Add a permission.
Select Microsoft Graph and click Application permissions.
Under Select Permissions, expand Users, and select User.Read.All permission.
Click Add Permissions.

Once you add the required permissions, click Grant admin consent for Default Directory to allow an admin to grant admin consent to the configured permissions.

Admin Consent Granted

Configuring a Pay-as-you-go Azure Account

Complete the following steps to configure your Pay-As-You-Go (PAYG) Azure account with Tanzu CloudHealth .

Step 1 - Register Tanzu CloudHealth App with Service Principal

Create a Tanzu CloudHealth App in the Azure portal and register it with a Service Principal Repeat this process for each directory you manage.

Prerequisite You must have global administrator privileges to register an App. While the connection between Tanzu CloudHealth and Azure is read-only, a global administrator must register the App to ensure that there are no errors.

Open a text editor (such as NotePad or TextEdit) so that you can store specific parameters of the service principal that you need to provide in Tanzu CloudHealth.
Log in to the Azure Portal.
From the left menu, select Azure Active Directory. If a menu entry for Azure Active Directory does not exist, search for it.
Select the App Registrations tile and then click New Registration from the top of the page.
Fill out the following fields in the form and then click Create:
- Name: Enter the name of the service principal
- Supported Account Types: Select Accounts in this organizational directory only.
- Redirect URI: Select Web from the dropdown and enter https://apps.cloudhealthtech.com Due to a a rare issue in the Azure Portal, creating a new app registration might fail to create a new service principal as expected. If this occurs, click the Create Service Principal link in App Registrations > Overview.
Open the Application Registration you just created.
- Copy the Display Name into the text document.
- Copy the Application ID into the text document.
Go to Certificates & Secrets in the left menu. Click New Client Secret.
- Add a key description. Make sure there are no spaces.
- Select a duration. It is recommended that you set the expiration to at least one year.
Click Save. A value is generated.
Copy the key description and value into the text document.
Close the App Registration blade and return to the Active Directory menu.
Under the Manage header, select Properties.
Locate the directory ID. Select the Copy icon to copy the ID and then paste it into the text document.

Checkpoint: At this point, you have this information in the text document.

Display Name
Application ID
Key Description
Key Value
Directory ID/Tenant ID

Step 2 - Add Reader Role for Subscriptions

Assign a Reader role for subscriptions that are managed in the directory.

For help assigning roles in Azure, see Assign Azure Roles using the Azure Portal.

When assigning the role, make the following selections:

Role: Reader
Members: Select the Service Principal created in Step 1.

Note - Repeat this step for each subscription.

Add Permissions to Access Key Vault (Optional)

With the additional get and list permissions, Tanzu CloudHealth gets access to keys and secrets for each key vault under each subscription. Providing this access offers the following benefits:

Visibility: Get all keys & secret details under each key vault in Asset reports.
Policies: Create policies on keys and secrets and get notified if any key/secret doesn’t have an expiry date set.
Perspectives: Since Key Vault Keys & Secrets are taggable assets, you can create perspective groups based on tags.

Use the following steps to grant additional permissions to the service principal:

Enter the following PowerShell script for every active Service Principal that you have added in Tanzu CloudHealth.

$subs = Get-AzureRmSubscription
$client_id = 'Application id of service principal'
foreach ($sub in $subs) {Set-AzureRmContext -SubscriptionId $sub.SubscriptionId
$key_vaults = Get-AzureRmKeyVault
foreach ($key_vault in $key_vaults) {Set-AzureRmKeyVaultAccessPolicy -VaultName $key_vault.VaultName -ServicePrincipalName $client_id -PermissionsToKeys get,list -PermissionsToSecrets get,list } }

Get the Application id of the service principal from Tanzu CloudHealth. Go to Setup > Accounts > Azure Service Principal.

The script accesses current key vaults and grant permission to the service principal to retrieve and display key vault keys and secrets.

In the Azure Portal, go to the newly added key vault.
From the Settings menu, navigate to Access Policies, and click Add Access Policy.
Select get, list permissions from the__ Key permissions__ and Secret permissions dropdown.
Select Service principal.
Click Add.

Step 3 - Connect Service Principal in Tanzu CloudHealth

Connect the Service Principal that you configured in the Azure portal to Tanzu CloudHealth.

In the Tanzu CloudHealth platform, navigate to select Setup > Accounts > Azure Service Principal. Then click New Service Principal.
Select Global Azure from the Account Type dropdown.
Copy the information from the text document into corresponding fields in the setup form. Make sure there are no spaces.
Optionally, select the Security Asset Collection dropdown if you want to disable asset collection on certain assets for security reasons. Tanzu CloudHealth recommends enabling asset collection for all assets and does not store sensitive data.

Disabled assets are marked as inactive in Tanzu CloudHealth and cannot be used in policies.
Click Save Service Principal.

Step 4 - Assign a Reader Role to Azure Reservation Orders

Log in to the Azure Portal and go to Azure Active Directory > App Registrations.
Copy the display name of the application you registered for Tanzu CloudHealth and paste it in a Text file (such as NotePad or TextEdit).
Log in to Tanzu CloudHealth. Go to Assets > Azure and select Reservation Orders from the Other section.
For the first reservation order in the table, select the Azure Portal icon to open that reservation order in the Azure Portal.
Go to Access Control (IAM) and click Add.
Fill out the fields as follows:
- Select Reader from the Role dropdown menu.
- In the Select field, copy and paste the service principal display name from step 2 that is associated with the reservation order and select the user returned by the search.
Click Save.
Repeat steps 4-7 for each reservation order.

Step 5 - Assign a Reader Role to Azure Savings Plans

Log in to the Azure Portal and go to Azure Active Directory > App Registrations.
Copy the display name of the application you registered for Tanzu CloudHealth and paste it in a Text file (such as NotePad or TextEdit).
Log in to the Tanzu CloudHealth platform. Go to Assets > Azure and select Savings Plans from the Other section.
In the Savings Plan table, click the Go to Azure Portal icon to open the savings plan in the Azure portal.
From the left pane, go to Access Control (IAM) and click Add role assignment.
Fill out the fields as follows:
- Select Reader from the Role dropdown menu.
- In the Select field, copy and paste the service principal display name from step 2 that is associated with the savings plan and select the user returned by the search.
Click Save.
Repeat steps 4-7 for each Savings Plan.

Step 6 - Configure Application Permission for Azure AD User Collection (Optional)

Tanzu CloudHealth supports Azure AD User collection through Azure Service Principal. To collect the Azure AD objects, you need to add an additional Graph API permission to the Service Principal.

Log in to the Azure Portal, go to Azure Active Directory > App Registrations, and select the Tanzu CloudHealth app.
Click API permissions > Add a permission.
Select Microsoft Graph and click Application permissions.
Under Select Permissions, expand Users, and select User.Read.All permission.
Click Add Permissions.

Once you add the required permissions, click Grant admin consent for Default Directory to allow an admin to grant admin consent to the configured permissions.

Configuring Microsoft Customer Agreement

Complete the following steps to configure Microsoft Customer Agreement with the Tanzu CloudHealth Platform.

Step 1 - Register Tanzu CloudHealth App with Service Principal

Create a Tanzu CloudHealth App in the Azure portal and register it with a Service Principal

Repeat this process for each directory you manage.

Prerequisite
You must have global administrator privileges to register an App. While the connection between Tanzu CloudHealth and Azure is read-only, a global administrator must register the App to ensure that there are no errors.

Open a text editor (such as NotePad or TextEdit) so that you can store specific parameters of the service principal that you need to provide in the Tanzu CloudHealth platform.
Log in to the Azure Portal.
From the left menu, select Azure Active Directory.

If a menu entry for Azure Active Directory does not exist, search for it.
Select the App Registrations tile and then click New Registration from the top of the page.
Fill out the following fields in the form and then click Create:
- Name: Enter the name of the service principal
- Supported Account Types: Select Accounts in this organizational directory only.
- Redirect URI: Select Web from the dropdown and enter https://apps.cloudhealthtech.com
Due to a a rare issue in the Azure Portal, creating a new app registration might fail to create a new service principal as expected. If this occurs, click the Create Service Principal link in App Registrations > Overview.
Open the Application Registration you just created.
- Copy the Display Name into the text document.
- Copy the Application ID into the text document.
Go to Certificates & Secrets in the left menu. Click New Client Secret.
- Add a key description. Make sure there are no spaces.
- Select a duration. It is recommended that you set the expiration to at least one year.
Click Save. A value is generated.
Copy the key description and value into the text document.
Close the App Registration blade and return to the Active Directory menu.
Under the Manage header, select Properties.
Locate the directory ID. Select the Copy icon to copy the ID and then paste it into the text document.

Checkpoint: At this point, you have this information in the text document.

Display Name
Application ID
Key Description
Key Value
Directory ID/Tenant ID

Step 2 - Add Reader Role for Subscriptions

Assign a Reader role for subscriptions that are managed in the directory.

For help assigning roles in Azure, see Assign Azure Roles using the Azure Portal.

When assigning the role, make the following selections:

Role: Reader
Members: Select the Service Principal created in Step 1.

Repeat this step for each subscription.

Add Permissions to Access Key Vault (Optional)

With the additional get and list permissions, Tanzu CloudHealth gets access to keys and secrets for each key vault under each subscription. Providing this access offers the following benefits:

Visibility: Get all keys & secret details under each key vault in Asset reports.
Policies: Create policies on keys and secrets and get notified if any key/secret doesn’t have an expiry date set.
Perspectives: Since Key Vault Keys & Secrets are taggable assets, you can create perspective groups based on tags.

Use the following steps to grant additional permissions to the service principal:

Enter the following PowerShell script for every active Service Principal that you have added in the Tanzu CloudHealth platform.

$subs = Get-AzureRmSubscription
$client_id = 'Application id of service principal'
foreach ($sub in $subs) {Set-AzureRmContext -SubscriptionId $sub.SubscriptionId
$key_vaults = Get-AzureRmKeyVault
foreach ($key_vault in $key_vaults) {Set-AzureRmKeyVaultAccessPolicy -VaultName $key_vault.VaultName -ServicePrincipalName $client_id -PermissionsToKeys get,list -PermissionsToSecrets get,list } }

Note - Get the Application id of the service principal from the Tanzu CloudHealth platform. Go to Setup > Accounts > Azure Service Principal.

The script accesses current key vaults and grant permission to the service principal to retrieve and display key vault keys and secrets.

In the Azure Portal, go to the newly added key vault.
From the Settings menu, navigate to Access Policies, and click Add Access Policy.
Select get, list permissions from the__ Key permissions__ and Secret permissions dropdown.
Select Service principal.
Click Add.

Step 3 - Add Service Principal as the Billing Account Reader

Assign the service principal as the billing account reader for the billing account.

Note - Repeat these steps for each billing account. To switch your scope to a different billing account, see Switch Billing Scope in the Azure Portal.

Log in to the Azure Portal.
From the left navigation, click All services, scroll down to General section, and click Cost Management + Billing. Or, type Cost Management + Billing in the search bar and press Enter.
On the Cost Management page, from the left menu, select Access Control (IAM).
Select +Add to add a new permission.
Fill out the Add Permission form as follows and click Save:
- Select Billing Account Reader from the Role dropdown.
- Enter the name of the service principal in the Select field.

Step 4 - Connect Service Principal in Tanzu CloudHealth

Connect the Service Principal that you configured in the Azure portal to the Tanzu CloudHealth Platform.

Log in to the Tanzu CloudHealth platform. From the left menu, select Setup > Accounts > Azure Service Principal. Then click New Service Principal.
Select Global Azure from the Account Type dropdown.
Copy the information from the text document into corresponding fields in the setup form. Make sure there are no spaces.
Optionally, select the Security Asset Collection dropdown if you want to disable asset collection on certain assets for security reasons. Tanzu CloudHealth recommends enabling asset collection for all assets and does not store sensitive data.

Disabled assets are marked as inactive in Tanzu CloudHealth and cannot be used in policies.
Click Save Service Principal.

Step 5 - Assign a Reader Role to Azure Savings Plans

Log in to the Azure Portal and go to Azure Active Directory > App Registrations.
Copy the display name of the application you registered for Tanzu CloudHealth and paste it in a Text file (such as NotePad or TextEdit).
Log in to the Tanzu CloudHealth platform. Go to Assets > Azure and select Savings Plans from the Other section.
In the Savings Plan table, click the Go to Azure Portal icon to open the savings plan in the Azure portal.
From the left pane, go to Access Control (IAM) and click Add role assignment.
Fill out the fields as follows:
- Select Reader from the Role dropdown menu.
- In the Select field, copy and paste the service principal display name from step 2 that is associated with the savings plan and select the user returned by the search.
Click Save.
Repeat steps 4-7 for each Savings Plan.

Step 6 - Assign a Reader Role to Azure Reservation Orders

To allow Tanzu CloudHealth reader-only access to your reservations, you must assign a reader role to all your reservation orders. Failure to do so will prevent your Azure reports from working correctly.

Log in to the Azure Portal and go to Azure Active Directory > App Registrations.
Copy the display name of the application you registered for Tanzu CloudHealth and paste it in a Text file (such as NotePad or TextEdit).
Log in to the Tanzu CloudHealth Platform. Go to Assets > Azure and select Reservation Orders from the Other section.
For the first reservation order in the table, select the Azure Portal icon to open that reservation order in the Azure Portal.
Go to Access Control (IAM) and click Add.
Fill out the fields as follows:
- Select Reader from the Role dropdown menu.
- In the Select field, copy and paste the service principal display name from step 2 that is associated with the reservation order and select the user returned by the search.
Click Save.
Repeat steps 4-7 for each reservation order.

Step 7 - Configure Application Permission for Azure AD User Collection (Optional)

The Tanzu CloudHealth platform supports Azure AD User collection through Azure Service Principal. To collect the Azure AD objects, you need to add an additional Graph API permission to the Service Principal.

Log in to the Azure Portal, go to Azure Active Directory > App Registrations, and select the app.
Click API permissions > Add a permission.
Select Microsoft Graph and click Application permissions.
Under Select Permissions, expand Users, and select User.Read.All permission.
Click Add Permissions.

Once you add the required permissions, click Grant admin consent for Default Directory to allow an admin to grant admin consent to the configured permissions.