Getting Started with Azure

Pump connects to your Azure tenant using a service principal with client credentials. You create the service principal and assign RBAC roles using the Azure CLI. Pump operates through Ingram Micro for Azure as a Microsoft CSP indirect solutions provider.

Prerequisites

Requirement	Details
Azure tenant	Active Azure AD tenant with at least one subscription
Permissions	Ability to create service principals (az ad sp create-for-rbac) and assign RBAC roles at the subscription or management group level
Azure CLI	Access to Azure Cloud Shell or a local az CLI installation
Pump account	Sign up at app.pump.co and complete email verification

How the connection works

Pump authenticates to your Azure tenant using a service principal (app registration) with a client secret. You create this service principal and grant it specific RBAC roles. Pump uses the standard OAuth2 client-credentials flow to access your billing and cost data.

Each Azure tenant is connected as a single entity in Pump. If your tenant contains multiple subscriptions, Pump discovers and tracks all of them automatically.

Step 1: Run a savings estimate

Before connecting programmatically, you can generate a savings estimate using a CSV upload.

1. Log in to Pump and select Azure as your cloud provider.

2. Select Estimate savings from CSV.

3. In the Azure Portal, navigate to Cost Management + Billing → Cost analysis and export your usage data for the last 3 months as a CSV.

4. Upload the CSV to Pump.

5. Pump generates your savings estimate within minutes.

After reviewing the estimate, you can proceed to connect your tenant.

Step 2: Create a service principal

This step creates the identity Pump uses to access your tenant.

1. Open Azure Cloud Shell (or your local terminal with az CLI).

2. Run the following command:

bash

az ad sp create-for-rbac --name pump

1. The command outputs a JSON object with the following fields:

json

{"appId":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","displayName":"pump","password":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","tenant":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"}

1. Copy these values. You will enter them in the Pump wizard:

Field	Maps to
appId	Application (client) ID
password	Client secret
tenant	Tenant ID

1. In the Pump onboarding wizard, enter the three values and submit.

Step 3: Assign read-only RBAC roles

This step grants Pump visibility into your billing and cost data.

Run the following commands in Azure Cloud Shell. Replace {subscription-id} with each subscription you want Pump to monitor:

bash

az role assignment create\  --assignee{appId}\  --role"Billing Reader"\  --scope /subscriptions/{subscription-id}

Repeat for each subscription in your tenant.

Role	Scope	Purpose
Billing Reader	Per subscription	Read-only access to billing data, cost reports, and usage details

After assigning the role, Pump begins pulling your cost data. Historical data backfill covers up to 90 days from the connection date.

Step 4: Authorize Pump as your billing partner

This step enables commitment management. Pump assigns additional RBAC roles at the management group or tenant level so it can purchase reservations and savings plans on your behalf.

1. In the Pump wizard, review the billing partner agreement.

2. Accept the Terms of Service and Privacy Policy.

3. Run the Pump-provided role assignment scripts in Azure Cloud Shell. These assign:

Role	Scope	Purpose
Pump Autopilot Role (custom)	Management group or tenant	Commitment purchase actions specific to Pump's optimization engine
Reservations Contributor	Management group or tenant	Manage Azure Reserved VM Instances
Savings Plan Contributor	Management group or tenant	Manage Azure Savings Plans
Reservations Purchaser	Management group or tenant	Purchase new Azure Reserved VM Instances
Savings Plan Purchaser	Management group or tenant	Purchase new Azure Savings Plans

1. Complete your company details and payment method.

After this step, your tenant is fully connected. Pump manages your commitments and generates savings.

How Azure solutions provider billing works

Pump operates through Ingram Micro for Azure as a Microsoft Cloud Solution Provider (CSP) indirect solutions provider. When you authorize Pump as your billing partner:

• Your Azure subscriptions continue to work as before. No resources or configurations change.

• Pump negotiates volume pricing and manages commitment purchases on your behalf.

• You receive one invoice from Pump that covers your Azure usage.

What Pump accesses

Data Pump reads

Data source	What Pump pulls	How it's used
Cost Management API	Detailed cost reports (generateDetailedCostReport)	Cost visibility, savings calculations
Consumption API	Usage details by subscription	Usage analysis, forecasting
Resource Groups	Resource group listing	Subscription and environment mapping
Billing API	Billing accounts, profiles, reservation details	Billing management
Reservation/Savings Plan APIs	Existing commitment details, utilization	Commitment tracking and renewal planning

Data Pump never accesses

Pump does not access your application data, Azure Key Vault secrets, storage account contents, source code, Azure Monitor logs, or Active Directory user data beyond the service principal. Pump does not use Azure Resource Graph, certificate-based authentication, federated credentials, or storage-account-based cost exports.

The only write actions Pump performs are purchasing reservations and savings plans when Autopilot roles are granted.

Historical data backfill

When you first connect with read-only access, Pump backfills up to 90 days of historical cost data. The backfill is chunked into 7-day jobs to avoid API rate limits. If your account is discovered automatically (via resource group detection), the initial backfill window is 30 days.

Ongoing data refreshes use a rolling 7-day window.

Troubleshooting

Service principal creation failed

Verify that your Azure AD user has the Application Administrator or Global Administrator role. The az ad sp create-for-rbac command requires permission to create app registrations.

Role assignment failed

Verify that your user has Owner or User Access Administrator on the target subscription. The Billing Reader role assignment requires permission to manage RBAC at that scope.

Pump is not receiving cost data

After assigning the Billing Reader role, it can take up to 30 minutes for Azure to propagate the role assignment. If data still does not appear after an hour, verify the role assignment with:

bash

az role assignment list --assignee{appId} --subscription{subscription-id}

If the role is listed but Pump still shows no data, contact Pump support at [e-mail].

Multi-subscription tenants

Pump automatically discovers all subscriptions in a connected tenant. You do not need to add subscriptions individually. However, the Billing Reader role must be assigned per subscription. If a subscription is missing from your Pump dashboard, check whether the role has been assigned to it.