Azure Cost Management Exports for CSP Accounts

For Cloud Solution Provider (CSP) setups, use this decision rule:

  1. Use billing-scope CME first (always preferred)
  2. If billing-scope CME is unavailable, choose one of these options:
    • Billing-account-scope CDR (preferred for MCA/EA billing accounts — single API call, no storage account)
    • Subscription-scope CME (one export per subscription), or
    • Subscription-scope CDR (one API call per subscription, no storage account)

Preferred Method: Billing-scope CME

When billing-scope CME is available, use the standard CME flow.

Follow:

If billing-scope CME is unavailable: remaining options

You have three supported options:

  1. Billing-account-scope CDR (preferred for MCA/EA billing accounts)
  2. Subscription-scope CME (one export per subscription)
  3. Subscription-scope CDR (fallback)

Option A: Subscription-scope CME

Use one export per subscription.

Follow:

Option B: Cost Details Report (CDR)

CDR (Cost Details Report) requests cost details directly from the Azure Cost Management API — no storage account or export schedule is required.

CDR has two scopes:

ScopeWhen to useAPI callsPermissions
Billing-account-scope (preferred for MCA/EA)You have billing account access and want a single call for all subscriptionsOne call per month for the entire billing accountBilling account reader (MCA billing role) + Cost Management Reader (Azure RBAC)
Subscription-scope (fallback)You only have subscription-level access, or legacy PAYGOne call per subscription per monthReader (or Cost Management Reader) on each subscription

Known limitations (both CDR scopes)

  • CDR does not include reservation actual transaction line items.
  • Management groups are not supported for CDR scope: Microsoft reference
  • No storage account permissions are required for CDR.

Supported subscription notes

CDR is available for subscriptions billed under EA or MCA billing structures, including standard CSP subscriptions and modern MCA-based PAYG subscriptions. It is not available for legacy/classic PAYG, MSDN, or Visual Studio subscriptions.

What Cloud Ctrl does with CDR

For connected subscriptions, Cloud Ctrl requests and downloads cost details reports and retries report generation on transient failures.

Option B1: Billing-account-scope CDR (preferred for MCA/EA)

Use this when you have billing account access. Cloud Ctrl issues a single generateCostDetailsReport call scoped to the entire billing account, covering all subscriptions under it — no need for per-subscription calls.

Find your billing account ID

  1. Sign in to the Azure Portal
  2. Go to Cost Management + Billing
  3. Select your billing account
  4. Copy the billing account ID from the overview page

ℹ️ MCA billing account IDs use a colon-separated format, e.g. 3c9d3f87-9dbe-518b-b2a8-644a0b367539:294812fb-ed11-450a-9b63-f63963c12ce2_2019-05-31. EA billing account IDs are numeric (e.g. 1234567).

Required Azure permissions for billing-account-scope CDR

Assign both of the following to the App Registration:

RoleTypeWhere to assign
Billing account readerMCA billing role (not Azure RBAC)Azure Portal → Cost Management + Billing → select billing account → Access Control (IAM) → Add role assignment
Cost Management ReaderAzure RBACAt the tenant root or on a subscription within the billing account

⚠️ The Billing account reader role is assigned on the billing account blade, not on a subscription. It is a billing-scoped role, separate from Azure RBAC roles like Reader.

If the generateCostDetailsReport call is rejected with 403 even after assigning Billing account reader, escalate to Billing account contributor — the POST action may require elevated billing permissions depending on the account configuration.

No storage account permissions are required for CDR.

Add billing-account-scope CDR in Cloud Ctrl

  1. Go to Settings → Cloud Connections → Microsoft Azure
  2. Add or select an Azure Entra App credential
  3. Add a cloud account using Cost Details Report (CDR) account type
  4. Enter the Billing Account ID you copied from the Azure Portal
  5. Submit and validate

Option B2: Subscription-scope CDR (fallback)

Use this when you only have subscription-level access (no billing account access), or for legacy/classic PAYG subscriptions. Cloud Ctrl issues a separate generateCostDetailsReport call for each subscription.

Required Azure permissions for subscription-scope CDR

Assign Reader (or Cost Management Reader) to the App Registration on each subscription to import.

No storage account permissions are required for CDR.

Add subscription-scope CDR in Cloud Ctrl

  1. Go to Settings → Cloud Connections → Microsoft Azure
  2. Add or select an Azure Entra App credential
  3. Add a cloud account using Cost Details Report (CDR) account type
  4. Leave the Billing Account ID field blank
  5. Submit and validate

Tips

When a new subscription is added, assign Reader access to the App Registration so it is included in CDR imports.