Azure cost optimization for engineering and finance teams.
Find out why your Azure bill grew, and what to cut. Omni FinOps will read your Azure cost export, inventory and metrics through a read-only app registration, explain every jump in plain dollars, and list the waste with the az command to fix it.
The Azure connector is coming soon. AWS and Google Cloud connect today; start a trial on one of them, and Azure joins the same account when it ships.
No card. Read-only access. Omni FinOps never changes your cloud.
Will read
- Daily cost and usage, from a Cost Management FOCUS export
- Inventory: virtual machines, managed disks and public IPs
- CPU metrics, from Azure Monitor
Can’t
- Create, change, stop or delete anything
- Read storage outside the cost export’s account
- Use a client secret: it signs in with a federated credential
Delete the app registration and access ends.
What it will flag in Azure
Every refresh checks each resource against these rules. A match becomes a lead with its monthly saving, the evidence behind it and the command to fix it. Nothing changes until your team runs it.
- Idle instancesCPU under 5% every day for two weeks. Stop it, or delete it if nothing needs it.
- Dev and staging running 24/7Tagged dev, test, staging, QA or sandbox and running around the clock. Run it weekdays 08:00–20:00 only.
- Unattached volumes and disksAttached to no instance. Delete it, after a snapshot if anyone might need it.
- Unused public IPsReserved, but attached to nothing. Release it.
How connecting Azure will work
A daily FOCUS export and one app registration with reader roles. A federated credential means there’s no client secret to store or rotate.
- 1Export cost data in FOCUS format. In Cost Management → Exports, create a daily Cost and usage details (FOCUS) export to a storage container.
- 2Register a read-only app. Give it Reader, Cost Management Reader and Monitoring Reader on the subscription, and Storage Blob Data Reader on the export’s storage account only. Assign at a management group to cover several subscriptions.
- 3Enter the details. Paste the tenant, application and subscription IDs and the export container’s URL into Cloud accounts.
The setup, in the terminal
az ad app create --display-name "Omni FinOps (read-only)"
az ad app federated-credential create --id <app-id> \
--parameters federated-credential.json
SCOPE=/subscriptions/<subscription-id>
for ROLE in "Reader" "Cost Management Reader" "Monitoring Reader"; do
az role assignment create --assignee <app-id> --role "$ROLE" \
--scope $SCOPE
done
az role assignment create --assignee <app-id> \
--role "Storage Blob Data Reader" \
--scope <export-storage-account-resource-id>Questions about Azure
- Can I connect Azure today?
- Not yet. Azure shows as Coming soon in the app until its connector ships, and this page shows the setup it will use. AWS and Google Cloud connect today.
- What will it be able to change?
- Nothing. Reader, Cost Management Reader and Monitoring Reader can only read, and Storage Blob Data Reader is limited to the storage account that holds the cost export.
- Why a FOCUS export?
- Cost Management writes your cost and usage details there every day in the FinOps FOCUS format, the same open format Omni FinOps reads from Google Cloud.
- What will it flag on Azure?
- Idle virtual machines, dev and staging VMs running around the clock, managed disks attached to nothing and public IPs nobody uses, each with the az command to fix it.
Start with AWS or Google Cloud today.
No card. Read-only access. Omni FinOps never changes your cloud.