> For the complete documentation index, see [llms.txt](https://help.pump.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.pump.co/azure/getting-started-with-azure.md).

# Getting Started with Azure

Pump connects to your Azure tenant using a service principal with client credentials. You create the service principal and assign RBAC roles using the Azure CLI. Pump operates through Ingram Micro for Azure as a Microsoft CSP indirect solutions provider.

### Prerequisites

| Requirement  | Details                                                                                                                               |
| ------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
| Azure tenant | Active Azure AD tenant with at least one subscription                                                                                 |
| Permissions  | Ability to create service principals (`az ad sp create-for-rbac`) and assign RBAC roles at the subscription or management group level |
| Azure CLI    | Access to Azure Cloud Shell or a local `az` CLI installation                                                                          |
| Pump account | Sign up at [app.pump.co](https://app.pump.co/) and complete email verification                                                        |

### How the connection works

Pump authenticates to your Azure tenant using a service principal (app registration) with a client secret. You create this service principal and grant it specific RBAC roles. Pump uses the standard OAuth2 client-credentials flow to access your billing and cost data.

Each Azure tenant is connected as a single entity in Pump. If your tenant contains multiple subscriptions, Pump discovers and tracks all of them automatically.

### Step 1: Run a savings estimate

Before connecting programmatically, you can generate a savings estimate using a CSV upload.

1. Log in to Pump and select **Azure** as your cloud provider.
2. Select **Estimate savings from CSV**.
3. In the Azure Portal, navigate to **Cost Management + Billing → Cost analysis** and export your usage data for the last 3 months as a CSV.
4. Upload the CSV to Pump.
5. Pump generates your savings estimate within minutes.

After reviewing the estimate, you can proceed to connect your tenant.

### Step 2: Create a service principal

This step creates the identity Pump uses to access your tenant.

1. Open **Azure Cloud Shell** (or your local terminal with `az` CLI).
2. Run the following command:

bash

```bash
az ad sp create-for-rbac --name pump
```

1. The command outputs a JSON object with the following fields:

json

```json
{"appId":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","displayName":"pump","password":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","tenant":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"}
```

1. Copy these values. You will enter them in the Pump wizard:

| Field      | Maps to                 |
| ---------- | ----------------------- |
| `appId`    | Application (client) ID |
| `password` | Client secret           |
| `tenant`   | Tenant ID               |

1. In the Pump onboarding wizard, enter the three values and submit.

### Step 3: Assign read-only RBAC roles

This step grants Pump visibility into your billing and cost data.

Run the following commands in Azure Cloud Shell. Replace `{subscription-id}` with each subscription you want Pump to monitor:

bash

```bash
az role assignment create\  --assignee{appId}\  --role"Billing Reader"\  --scope /subscriptions/{subscription-id}
```

Repeat for each subscription in your tenant.

| Role           | Scope            | Purpose                                                           |
| -------------- | ---------------- | ----------------------------------------------------------------- |
| Billing Reader | Per subscription | Read-only access to billing data, cost reports, and usage details |

After assigning the role, Pump begins pulling your cost data. Historical data backfill covers up to 90 days from the connection date.

### Step 4: Authorize Pump as your billing partner

This step enables commitment management. Pump assigns additional RBAC roles at the management group or tenant level so it can purchase reservations and savings plans on your behalf.

1. In the Pump wizard, review the billing partner agreement.
2. Accept the Terms of Service and Privacy Policy.
3. Run the Pump-provided role assignment scripts in Azure Cloud Shell. These assign:

| Role                         | Scope                      | Purpose                                                            |
| ---------------------------- | -------------------------- | ------------------------------------------------------------------ |
| Pump Autopilot Role (custom) | Management group or tenant | Commitment purchase actions specific to Pump's optimization engine |
| Reservations Contributor     | Management group or tenant | Manage Azure Reserved VM Instances                                 |
| Savings Plan Contributor     | Management group or tenant | Manage Azure Savings Plans                                         |
| Reservations Purchaser       | Management group or tenant | Purchase new Azure Reserved VM Instances                           |
| Savings Plan Purchaser       | Management group or tenant | Purchase new Azure Savings Plans                                   |

1. Complete your company details and payment method.

After this step, your tenant is fully connected. Pump manages your commitments and generates savings.

#### How Azure solutions provider billing works

Pump operates through Ingram Micro for Azure as a Microsoft Cloud Solution Provider (CSP) indirect solutions provider. When you authorize Pump as your billing partner:

* Your Azure subscriptions continue to work as before. No resources or configurations change.
* Pump negotiates volume pricing and manages commitment purchases on your behalf.
* You receive one invoice from Pump that covers your Azure usage.

### What Pump accesses

#### Data Pump reads

| Data source                   | What Pump pulls                                    | How it's used                            |
| ----------------------------- | -------------------------------------------------- | ---------------------------------------- |
| Cost Management API           | Detailed cost reports (generateDetailedCostReport) | Cost visibility, savings calculations    |
| Consumption API               | Usage details by subscription                      | Usage analysis, forecasting              |
| Resource Groups               | Resource group listing                             | Subscription and environment mapping     |
| Billing API                   | Billing accounts, profiles, reservation details    | Billing management                       |
| Reservation/Savings Plan APIs | Existing commitment details, utilization           | Commitment tracking and renewal planning |

#### Data Pump never accesses

Pump does not access your application data, Azure Key Vault secrets, storage account contents, source code, Azure Monitor logs, or Active Directory user data beyond the service principal. Pump does not use Azure Resource Graph, certificate-based authentication, federated credentials, or storage-account-based cost exports.

The only write actions Pump performs are purchasing reservations and savings plans when Autopilot roles are granted.

### Historical data backfill

When you first connect with read-only access, Pump backfills up to 90 days of historical cost data. The backfill is chunked into 7-day jobs to avoid API rate limits. If your account is discovered automatically (via resource group detection), the initial backfill window is 30 days.

Ongoing data refreshes use a rolling 7-day window.

### Troubleshooting

#### Service principal creation failed

Verify that your Azure AD user has the `Application Administrator` or `Global Administrator` role. The `az ad sp create-for-rbac` command requires permission to create app registrations.

#### Role assignment failed

Verify that your user has `Owner` or `User Access Administrator` on the target subscription. The `Billing Reader` role assignment requires permission to manage RBAC at that scope.

#### Pump is not receiving cost data

After assigning the Billing Reader role, it can take up to 30 minutes for Azure to propagate the role assignment. If data still does not appear after an hour, verify the role assignment with:

bash

```bash
az role assignment list --assignee{appId} --subscription{subscription-id}
```

If the role is listed but Pump still shows no data, contact Pump support at [support@pump.co](https://support.pump.co/).

#### Multi-subscription tenants

Pump automatically discovers all subscriptions in a connected tenant. You do not need to add subscriptions individually. However, the Billing Reader role must be assigned per subscription. If a subscription is missing from your Pump dashboard, check whether the role has been assigned to it.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.pump.co/azure/getting-started-with-azure.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.