Skip to content
NewFinOps, Kubernetes and AI, on one platform
Book a demo
UnitVane docs
API referenceReleases

Connect Azure billing

Export amortized cost from Cost Management to a storage account and give KubeOn's identity read access.

Who does what

How Azure data reaches KubeOn

  1. 01

    Billing export

    A daily Cost Management export of amortized cost or FOCUS data to a storage account you own.

    Your storage account

  2. 02

    Read-only access

    A managed identity with Storage Blob Data Reader on the export and Cost Management Reader on the scope.

    KubeOn managed identity

  3. 03

    Cluster snapshots

    A cluster token from KubeOn. No workload identity or storage account: snapshots go to your organization in KubeOn and nowhere else.

    Agent in each cluster

  4. 04

    Allocate + reconcile

    The hub joins hourly snapshots with the bill, allocates each node's cost to pods, teams and labels, and reconciles every cluster to its bill.

    KubeOn hub

The KubeOn agent never changes your clusters. The billing identity only reads, and the agent can only write snapshots.

On this page

No keys needed

In Integrations > Connect a cloud, choose your cloud and select Keyless. You create no key, password or secret. Your cloud checks that the request is for your organization ID, which KubeOn sets and no organization can change. The page fills that ID into the commands.

Create the export and grant access

Azure CLI
# 1. Export amortized cost (FOCUS) daily to a storage accountaz costmanagement export create \  --name kubeon-daily \  --scope "/subscriptions/00000000-0000-0000-0000-000000000000" \  --storage-account-id "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/finops/providers/Microsoft.Storage/storageAccounts/acmecostexports" \  --storage-container cost-exports \  --storage-directory kubeon \  --timeframe MonthToDate \  --type AmortizedCost \  --recurrence Daily \  --recurrence-period from="2026-10-01T00:00:00" to="2027-10-01T00:00:00"# 2. Let the KubeOn identity read the export and cost dataaz role assignment create \  --assignee "<kubeon-managed-identity-client-id>" \  --role "Storage Blob Data Reader" \  --scope "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/finops/providers/Microsoft.Storage/storageAccounts/acmecostexports"az role assignment create \  --assignee "<kubeon-managed-identity-client-id>" \  --role "Cost Management Reader" \  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"

Exports can be created at subscription, resource group, management group or billing account scope. Create one per scope you want covered, or one at billing account scope for everything.

Add the integration

In Settings > Integrations, choose Azure and enter the storage account, container and directory. Use the managed identity client ID shown on the page.

Amortized or FOCUS

KubeOn reads both the amortized cost export and the FOCUS export. Amortized cost spreads reservations and savings plans over the hours they cover, which is what allocation needs.

Tags and labels

Azure resource tags and Kubernetes labels resolve to the same owner keys through tag normalization, so a CostCenter tag on a node pool and a cost-center label on a pod land in the same column.

Need help with this guide?Contact support
PreviousConnect AWS billingNext Connect Google Cloud billing