Adding Azure account with Read/Write access with Entire tenant using Automatic connection

You need permission to create service clients and assign roles to add an Azure subscription. In detail, you need:

Owner on the management group you connect (or User Access Administrator plus Cost Management Contributor).
Read/write access also creates a custom role on the management group, which needs Owner or User Access Administrator there.
To connect the whole tenant (the tenant root management group), a Global Administrator first turns on Microsoft Entra ID → Properties → Access management for Azure resources, assigns themselves Owner on the root management group, and restarts Cloud Shell.

Without these rights, Step 10 fails with AuthorizationFailed on roleAssignments/write or roleDefinitions/write, and Step 11 with (401) No Access for managementGroupId. A failed Step 10 leaves the new Uniskai app registration behind: delete it in Entra ID → App registrations before retrying.

Step 1

Skip to Step 3 if you came to this guide from the Connect your Azure subscription

page.

Go to the "Account Manager" tab, pinned at the bottom of the left menu.

Your Account Manager menu will look like the picture below if you don't have any accounts. Click the ‘Add environment’ button.

If you already have some accounts, your Account Manager menu will display differently. Click the ‘Add environment’ button.

Choose Azure cloud service.

Select Entire tenant.

Step 2

You will be directed to the ‘Connect your Azure tenant’ page.

Step 3

In the first field, enter an Account name. You can use a specific name (up to 32 characters) or leave it as the default ‘AZURE.’

Step 4

Choose the Access type (The selected type will be marked with a white dot on a blue background):

Read/write: You will get full visibility of your cloud environment and optimization insights
Read-only: You will be able to actively save money and fix all issues

For this manual, we use Read/Write mode

Step 5

Then, select the Connection (the selected connection will have a white point on a blue background):

Automation: A shell script will automatically create a JSON key file.
Manual: You will need to create a new Service Principal manually and provide connection metadata.

Now, select the Automatic connection.

Step 6

Cloud Shell will look like this:

Step 7

Note: When opening the shell for the first time, you'll be prompted to create a new storage account. You can create one automatically with a click on ‘Create storage’ or set the storage account and file share names using advanced settings.

A Cloud Shell with a PowerShell terminal appears after storage creation.

If PowerShell mode is not active, click "Switch to PowerShell."

Step 8

Import the setup automation module by executing this command (just paste the next code into the Cloud Shell terminal):

Invoke-Expression $([System.Text.Encoding]::UTF8.GetString($(Invoke-WebRequest -Uri `
"https://uniskai-eu-templates.s3.eu-central-1.amazonaws.com/azure/setup-uniskai-connection.ps1" `
-UseBasicParsing).Content))

Executed code will look like this:

Step 9

Define the scope for connection. Find your Management ID in the Management Groups, which lists all entities associated with your Azure account and includes the name and ID for each one.

$Scope = '/providers/Microsoft.Management/managementGroups/<YOUR_MANAGEMENT_GROUP_ID>'

Step 10

Run the setup procedure. Use -Access ReadWrite for read/write access:

$Connection = Setup-UniskaiConnection `
	-Access 'ReadWrite' `
	-Scope $Scope `
	-ApplicationName 'Uniskai' `
	-PrincipalId '' 
$Connection

Step 11

Configure Azure cost exports.

Replace <SUBSCRIPTION_ID_FOR_BILLING_STORAGE> with the subscription where the billing export storage account should be created. Run az account list -o table to see your subscriptions.

$StorageSub = '<SUBSCRIPTION_ID_FOR_BILLING_STORAGE>'

Setup-CostExports `
    -Scope $Scope `
    -PrincipalId $Connection.principal_id `
    -StorageAccountId '' `
    -StorageSubscriptionId $StorageSub `
    -HistoryMonths 12

On Pay-As-You-Go, CSP and other non-EA tenants the script warns “… has no Enterprise Agreement subscriptions, so it can’t be exported as a whole. Creating cost exports for each of its subscriptions instead.”, configures each subscription in turn, and ends with “Cost exports created for N of N subscriptions”.

A subscription listed as failed: check that you are Owner of it (or have Cost Management Contributor), then run Step 11 again.
Subscriptions added to the management group later are not exported automatically. Run Step 11 again with the storage account you already have, so the data stays in one place: -StorageAccountId (az storage account list -g uniskai --subscription $StorageSub --query "[0].id" -o tsv). Re-running is safe: it updates the existing Uniskai exports. Exports created with the single subscription guide are not picked up by an entire tenant connection, so always add subscriptions by re-running Step 11.

Step 12

Download the setup script’s generated config file. The Setup-UniskaiConnection command in Step 10 has already created the file uniskai-connection.json.

Note: If you’re using Azure Cloud Shell, click the Upload/Download files button on the toolbar, choose Download, enter the file name uniskai-connection.json, and click Download. Then click on the “Click here to download your file.” link that appears on the bottom right.

Troubleshooting

1. If you see $0 in Uniskai billing after refreshing the account, please check that you have access to view Azure costs in this subscription. If you don’t see any values in Cost analysis or your export files have all cost columns equal to 0, ask your admin to enable policy to view Azure charges.

2. Cost exports for a whole tenant or management group. Azure supports a single cost export for a management group only for Enterprise Agreement (EA) subscriptions. The script picks the right setup for you:

Enterprise Agreement: one export for the management group.
Microsoft Customer Agreement: one export for your billing account, when you can see exactly one. If the script lists several billing accounts, run Setup-CostExports again with -Scope /providers/Microsoft.Billing/billingAccounts/<billing-account-id>. This needs the Billing account owner or contributor role.
Pay-As-You-Go, CSP, or a group with no EA subscriptions: the script creates exports for every subscription in the management group, all into one storage account. You don’t need to connect the subscriptions one by one.

If the script stops before any export is created, it deletes the storage account it created.

3. (SubscriptionNotFound) Subscription … was not found when creating the storage account. The Microsoft.Storage resource provider is not registered in that subscription. Run

az provider register -n Microsoft.Storage --subscription <subscription-id> --wait

then run Step 11 again.

Step 13

Go to the Uniskai page and upload the created JSON file:

Check all information and click the ‘Connect subscription’ button:

Step 14

The account was successfully connected; you can see the connected account on the Account Manager page:

Articles you may find useful

Azure Cloud Platform. How to Configure Cost Exports?