Azure permissions needed for cost and estate reporting

Reporting inherits your permissions

Cloudledger reads Azure with the signed-in person’s delegated permissions. If Azure would refuse you a figure, the application cannot show it either. That makes access the first thing to check when a report looks incomplete, before assuming the data is missing or the tool is wrong.

Cost and inventory need different roles

Reading billed cost generally requires a cost-focused role at the relevant scope, while resource inventory needs read access to the resources themselves. Having one without the other produces a report that is genuinely partial: inventory without cost, or cost without the resources behind it.

1. Confirm read access on the subscriptions you expect to see.
2. Confirm cost access at the appropriate billing or subscription scope.
3. Check whether management-group scope is needed for the estate view.
4. Re-check after subscriptions are added or access is changed.

Directory data changes what names appear

Without directory read permission, role assignments can only be shown as object identifiers rather than people’s names. The access reports still work; they are simply harder to read. Adding that permission is a decision about visibility of directory data and belongs with the directory owners.

Deployment is a separate privilege

Reading costs and creating resources are different acts. Build requires workspace-admin authorization inside Cloudledger, explicit confirmation, and sufficient Azure permissions for the target subscription and resource group. None of the reporting screens acquire that ability implicitly.

When access expires

Session tokens and delegated access can expire. When that happens the honest outcome is an explicit message, not an empty chart. Renew the tenant session in Settings, then re-run the report and confirm the scope is complete before using the figures.