Configure a EA or MCA Account with a Service Principal
Create an Account in CloudCheckr
Launch CloudCheckr.
On the Home page, type Account Hierarchy in the Search bar at the top of the screen.
The Accout Hierarchy page opens with the Accounts tab displayed by default.
On the Accounts page, click the + NEW button.
Select Account from the fly-out menu. The Create Account sub-drawer opens.
Type a name for your account.
Select Azure as your cloud provider from the drop-down menu.
From the Location drop-down menu, select an option if you want to put your account within an existing folder.
If you have a Payer account, select an option from the Payee Organizations drop-down menu that best fits how you want to create any future Payee accounts:
Place new payees at hierarchy root (default): CloudCheckr automatically places auto-created Payee accounts at the root (no parent group)
Place new payees in same parent group as payer: CloudCheckr automatically places any newly created Payee accounts within the same group as the Payer account
Place new payees in a specific location: CloudCheckr allows you to select an account group where it to place all auto-created Payee accounts
From the Attributes drop-down menu, select attributes that you want to apply to your account. Attributes are key/value pairs that help your organize and categorize your accounts in CloudCheckr CMx — similar to how account-level tags work currently in CloudCheckr. For the purposes of this procedure, we won't add any attributes during our initial configuration.
Click SAVE. CloudCheckr CMx saves your new account and the page now displays the Edit Account sub-drawer.
From the Edit Account sub-drawer, click on Manage Credentials.
Select MCA or Enterprise Agreement Account (Using Service Principal).
On the following page, select Collect billing data from my Microsoft Customer Agreement. Then, select the Use Service Principal with Secret Key tab.
Three parameters are required: your Directory/Tenant ID, App Registration ID, and Secret Key. Open a new tab and proceed to step 2.
Login to the Azure Portal
Navigate to Microsoft Entra ID > App Registrations.
Click + New registration.
Create your application:
Type a name for your application
Select Accounts in this organizational directory only for supported accounts
Under Redirect URI (optional), select Web, and in the URI field, type https://localhost
Click Register
Once the application is created, you will need to collect the Application ID and the Directory (tenant) ID. Use a program like NotePad to copy/paste these parameters as they will be needed later.
In the Manage section of the application blade, click Certificates & secrets.
Under Certificates & secrets, click + New client secret.
Type a name for the client secret, select a timeframe when you want it to expire, and click Add.
Copy the client secret and save it immediately since you will not be able to view it again.
In order to add the Enrollment Reader role to the Service Principal, you will need to use the Role Assignments - Put API call.
Sign in as an Enterprise Administrator, then click the green 'try it' button to open the API testing screen.
In the Azure portal, navigate to Cost Management + Billing
Select the billing scope.
Navigate to Access control (IAM)
Click + Add
For role, select Billing account reader. Search for the service principal you created.
Click Add
Back in CloudCheckr:
Input the Directory/Tenant ID, Application ID, and the Secret Key.
Select the Azure account type (Commercial or Government).
