Skip to main content

Grant Single Subscription Permissions

note

This guide is to be performed once per Azure Subscription.
The guide assumes that you have already created an Azure App Registration in your Azure Tenant.
If you haven't created an App Registration yet, please follow the Create a New Azure App Registration guide.

This guide will walk you through the process of granting permissions to your Azure Subscription for the Chronom App Registration you created.

Prerequisites​

In order to grant permissions to the App Registration, you need to have:

  • An Active Azure Subscription.
  • An Azure App Registration with a client secret. Create a New Azure App Registration
  • The ability to create a custom role in the subscription you want to scan.
  • The ability to assign the custom role to the App Registration.
    (Those abilities are usually granted by the Owner role in the subscription)

Instructions​

If you want to grant Chronom the ability to perform a more in-depth scan of your Azure Subscription, you can create a custom role with the necessary permissions.

To create a custom role, follow these steps:

  1. Download the Chronom Custom Role JSON file by clicking here and saving it to your computer.

  2. Open the Azure Portal.

  3. Navigate to the Azure Subscription you want to create the custom role in.

  4. Click on the Access Control (IAM) blade.

  5. Click on the + Add button and select Add custom role.

    Add Custom Role

  6. Fill in the following details:

    • Baseline Permissions: Start from JSON
    • Upload the JSON file you downloaded in step 1.
    • Click on the Next button.

    Create Custom Role

  7. Review the permissions and click on the Next button.
    If the permissions are too broad, you can remove the problematic permissions by clicking on the 🗑️ icon.
    (Any of the permissions can be removed except for the */read permissions.)
    In addition, you can exclude specific actions by clicking on the + Exclude permissions button.

  8. Under Assignable scopes click Add assignable scopes, change the type to Subscription and select the subscriptions you want to assign the role to.
    Click on the Select button and then click Next.

    Add Assignable Scopes

  9. Review the role JSON and click on the Review + create button. If you prefer, you can modify the role permissions by clicking on the Edit button.
    (any of the permissions can be removed except for the */read permissions.)

  10. Review the role details and click on the Create button once you are ready.

Grant Permissions to the App Registration​

To grant permissions to the App Registration, Follow these steps:

  1. Open the Azure Portal.

  2. Navigate to the Azure Subscription you want to grant permissions to.

  3. Click on the Access Control (IAM) blade.

  4. Click on the + Add button and select Add role assignment.

    Add Role Assignment

  5. Search for the Role that will be assigned to the App Registration.
    If you created a custom role in the previous stage, search for the role name you created (Most likely Chronom Reader), otherwise, search for the Reader role.
    Select the role and click on the Next button.

    Select Role

  6. Click on the + Select members and search for Chronom Read-Only App Registration (or the name you gave to the App Registration).
    Select the App Registration and click on the Select button then click Next.

    Select Members

  7. Click on the Review + assign button.

  8. On a new tab, navigate to Chronom's Integrations Page and click on the + Add a subscription under <Your Tenant Name> button.

    Add Subscription

  9. Copy the Subscription ID and paste it in the Subscription ID field on the Azure Portal, then select the rate of scans for the subscription and click on the Save button.

    Add Subscription

Grant Reservation Permissions

  1. Browse to the Reservations page in the Azure Portal.

  2. Click on Role assignments in the right-hand side menu. Click Role assignments

  3. Click on the + Add button and select Add role assignment. Add Role Assignment

  4. In the Role assignment page:

    • Role: Select Reservation Reader
    • Assign access to: Select User, group, or service principal
    • Members: Search for and select Chronom Read-Only App Registration (the app registration created in previous steps)
    • Click Review + assign and then Assign Select Reservation Reader Add Chronom Read-Only App Registration
    note

    The Reservation Reader role allows the App Registration to read reservation details and utilization data, which is necessary for cost optimization insights in Chronom.