---
sourceDocument: Australia Asset Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/it-asset-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Asset Management

ft:clusterId :

    - itam

bundleId :

    - itam

workflow :

    - Technology


---

# Create a Microsoft Azure service principal

# Create a Microsoft Azure service principal {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Give Cloud Cost Management access to Microsoft Azure billing and usage data by creating a Microsoft Azure service principal.

## Before you begin

Microsoft Azure Role required: Azure Cloud admin

## About this task

Cloud Cost Management supports Microsoft Azure billing and cost usage data for multiple types of billing agreements: Enterprise Agreement (EA), Microsoft Customer Agreement (MCA), and Microsoft Partner Agreement (MPA). There are
specific roles that you must assign to the service principal depending on your billing agreement type. For more information on agreement types, see [Billing information for Microsoft Azure](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/manage-billing-access).

## Procedure

1. From a web browser, open the [App Registrations page](https://portal.azure.com/?Microsoft_AAD_RegisteredApps=true#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) of the Microsoft Entra ID portal.
2. Log in using your global administrator credentials.
3. In the Name field of the Register an application form, enter a name for the application.
4. In the Supported account types field, select Accounts in any organizational directory (Any Microsoft Entra ID -- Single tenant).
5. Select Register.  
   The application is registered and you're redirected to the Overview page of the new application.
6. On the Overview page, copy the values in the Application (client) ID and Directory (tenant) ID fields.  
   Save them in a secure location for later use.
7. Generate a Client secret for your application.
   1. From the side navigation menu, navigate to ManageCertificates \& secrets.
   2. In the Client secrets section, generate a client secret for the application by selecting New client secret.
   3. In the dialog box, fill in the fields.  
      {#create-ms-azure-service-principal__table_oqr_qkn_sfc__entry__2}

      | Field | Description |
      |-|-|
      | Description | Description of the client secret. |
      | Expires | Expiration of the client secret. Note: Your organization might apply policies to restrict client secret durability. Select an appropriate expiration period. |
      [Table 1. Add a client secret dialog box]

      {#create-ms-azure-service-principal__table_oqr_qkn_sfc}
   4. Select Add.
   5. Copy the client secret that is generated and save at a secure location for later use.
   {#create-ms-azure-service-principal__substeps_vss_gkn_sfc}
8. Get Subscription ID to enable the service principal to work with various Azure subscriptions.
   1. Navigate to Subscriptions.
   2. Select the Subscription ID to which the service principal needs access.
   3. Copy the Subscription ID from the Subscription Overview page and secure it for later use.  
      You require the Subscription ID while adding an Azure service account.
   {#create-ms-azure-service-principal__substeps_ap1_kln_sfc}
9. Assign access roles and permissions to the service principal depending on your billing agreement type.  
   Refer to the table for required roles and permissions for the service principal.{#create-ms-azure-service-principal__table_xcg_xln_sfc__entry__3}

   | Billing agreement type | Role required | Permissions |
   |-|-|-|
   | Enterprise Agreement (EA) | * Enrollment Reader * Storage Blob Data Reader {#create-ms-azure-service-principal__ul_vnq_jyw_fgc} | These permissions are required for the service principal for all billing agreement types. * Microsoft.Compute/virtualMachines/instanceView/read * Microsoft.Compute/virtualMachines/deallocate/action * Microsoft.Compute/virtualMachines/start/action * Microsoft.Compute/virtualMachines/delete * Microsoft.Compute/virtualMachines/write * Microsoft.Compute/virtualMachines/read * Microsoft.Compute/locations/usages/read * Microsoft.Advisor/recommendations/read * Microsoft.Advisor/generateRecommendations/read * Microsoft.Advisor/generateRecommendations/action * Microsoft.Compute/disks/delete * Microsoft.Compute/disks/read * Microsoft.CostManagement/forecast/read * Microsoft.Compute/locations/diskOperations/read * Microsoft.Insights/Metrics/Read * Microsoft.Compute/locations/operations/read * Microsoft.Sql * Microsoft.DBforMariaDB * Microsoft.DBforMySQL {#create-ms-azure-service-principal__ul_kqk_1mn_sfc} |
   | Microsoft Customer Agreement (MCA) | * Billing Account Reader * Both Billing Profile Reader and Billing Reader * Storage Blob Data Reader {#create-ms-azure-service-principal__ul_uhm_2k3_c3c} | These permissions are required for the service principal for all billing agreement types. * Microsoft.Compute/virtualMachines/instanceView/read * Microsoft.Compute/virtualMachines/deallocate/action * Microsoft.Compute/virtualMachines/start/action * Microsoft.Compute/virtualMachines/delete * Microsoft.Compute/virtualMachines/write * Microsoft.Compute/virtualMachines/read * Microsoft.Compute/locations/usages/read * Microsoft.Advisor/recommendations/read * Microsoft.Advisor/generateRecommendations/read * Microsoft.Advisor/generateRecommendations/action * Microsoft.Compute/disks/delete * Microsoft.Compute/disks/read * Microsoft.CostManagement/forecast/read * Microsoft.Compute/locations/diskOperations/read * Microsoft.Insights/Metrics/Read * Microsoft.Compute/locations/operations/read * Microsoft.Sql * Microsoft.DBforMariaDB * Microsoft.DBforMySQL {#create-ms-azure-service-principal__ul_kqk_1mn_sfc} |
   | Microsoft Partner Agreement (MPA) | * Billing Reader * Storage Blob Data Reader {#create-ms-azure-service-principal__ul_vkc_tww_fgc} | These permissions are required for the service principal for all billing agreement types. * Microsoft.Compute/virtualMachines/instanceView/read * Microsoft.Compute/virtualMachines/deallocate/action * Microsoft.Compute/virtualMachines/start/action * Microsoft.Compute/virtualMachines/delete * Microsoft.Compute/virtualMachines/write * Microsoft.Compute/virtualMachines/read * Microsoft.Compute/locations/usages/read * Microsoft.Advisor/recommendations/read * Microsoft.Advisor/generateRecommendations/read * Microsoft.Advisor/generateRecommendations/action * Microsoft.Compute/disks/delete * Microsoft.Compute/disks/read * Microsoft.CostManagement/forecast/read * Microsoft.Compute/locations/diskOperations/read * Microsoft.Insights/Metrics/Read * Microsoft.Compute/locations/operations/read * Microsoft.Sql * Microsoft.DBforMariaDB * Microsoft.DBforMySQL {#create-ms-azure-service-principal__ul_kqk_1mn_sfc} |
   [Table 2. Roles and permissions for Azure service principal]

   {#create-ms-azure-service-principal__table_xcg_xln_sfc}

## What to do next

[Create a record of Microsoft Azure credentials in Cloud Cost Management](https://servicenow-prod.fluidtopics.net/WFdzpcvuzEHr_3y_mz40qw "Securely store your Microsoft Azure credentials in the ServiceNow AI Platform credentials store. You must create a service account that accepts billing data for Cloud Cost Management.")
**Related tasks**   

* [Add the Enrollment Reader role to the Microsoft Azure service principal](https://servicenow-prod.fluidtopics.net/KBO7fs_FJqiSwbGx9kd7kQ "Assign the Enrollment Reader role to the Azure service principal for your Enterprise Agreement (EA) account to retrieve billing, purchase, and pricing data. You can assign this role using a Microsoft API.")
* [Add the Billing Profile Reader role to the Microsoft Azure service principal](https://servicenow-prod.fluidtopics.net/x4nKN2cxkn~O6MjHk37RRQ "Assign the Billing Profile Reader role to the Azure service principal for your Microsoft Customer Agreement (MCA) account to download Azure price sheet data.")

*[\>]: and then