Overview

This guide walks you through the steps to connect your Azure Enterprise Agreement (EA) cost data to Ripple.

By the end of this process, you will need to share the following information with Alphaus to enable Azure EA cost data to be reflected in Ripple:

Application (client) ID
Directory (tenant) ID
Client Secret

Step 1: Register an app in Microsoft Entra ID (Azure AD)

📖 Reference: Microsoft - How to register an app in Microsoft Entra ID

Sign in to the EA tenant as an Azure AD Administrator
In the Azure Portal, go to Microsoft Entra ID > App registrations > New registration
Fill in the following fields:
1. Name: e.g. ea-cost-management-api-client
2. Supported account types: Select Single tenant for EA scenarios
3. Redirect URI: Optional for client credentials flow — leave blank or enter a placeholders
Click Register
On the application overview screen, copy and save the following:
1. Application (client) ID
2. Directory (tenant) ID

Notes: These values are used for application authentication.

Step 2: Create a Client Secret (or Certificate) for the Application

📖 Reference: Microsoft - Add and manage app credentials in Microsoft Entra ID

In the same application, go to Certificates & secrets
Under Client secrets, choose New client secret
Set a description and an expiration period, then click Add
Immediately copy and save the Value of the newly created Client Secret

Important Notes The Client Secret value will not be displayed again after you leave this page.

After completing this step, you will have the following API credentials required for the OAuth 2.0 client credential flow:

Tenant ID
Client ID
Client Secret

Step 3: Verify EA Association and Admin Role

Confirm your EA enrolment is linked to this Azure AD tenant
Sign in using one of the following roles:
- Enterprise Administrator or
- Account Owner (depending on how EA is delegated)
For partner-managed EA:
- Microsoft - EA billing administration for partners in the Azure portal
For direct EA management:
- Microsoft - EA Billing administration on the Azure portal

You will need permission to grant access to Cost Management data for the EA enrolment.

How to Verify:

In the Azure Portal, go to Cost Management + Billing > Billing scopes
Confirm that the EA enrollment / billing account is listed under this tenant

You should see your EA enrollment / billing account under this tenant.

Important Notes If the EA enrollment does not appear under Cost Management + Billing, you may not have the appropriate role or may be signed in to the wrong tenant.

Step 4: Grant the Service Principal Access to the Billing (EA) Scope

📖 References:

Granting permissions to the service principal consists of two parts:

Granting access to Cost Management data
Setting the appropriate access scope (Enrolment / Billing account / Subscription / Resource group)

4.1. Assign billing / Cost Management roles

In the Azure portal, go to Cost Management + Billing
If multiple billing scopes are available, select the appropriate scope from Billing scopes based on the cost data you want to retrieve:
- EA Enrollment
- Billing Account
- Billing Profile / Invoice Section
Open Access Control (IAM) or the equivalent access management screen for the selected scope
Click Add role assignment and assign the following roles to the application at the Billing account scope:
- Cost Management Reader — for viewing cost data
- EnrolmentReader — for viewing data across enrolment, department, and account scopes
- Billing Reader — for viewing subscription and billing data
Under Members > User, group, or service principal > search for the application by name, select it, and click Save

4.2. Grant Access at the Azure Resource Scope (if required)

If you need to retrieve costs at the subscription or resource group level:

Open the relevant to Subscriptions (or a specific Resource group / Management group)
Click Access control (IAM)
Click Add role assignment
Select Cost Management Reader or Reader
Assign it to the same service principal and click Save