Guide updated
Implemented from Microsoft's official Credits and Entra documentation. Live-account verification is pending, including signed-in setup, Billing profile reader access and invoice reconciliation. Automated tests are not account verification.
- Required credentials
- Client secret Value
- Monitoring currency
- USD · Global commercial Azure
- What is monitored
- MCA Credits · After last invoice
- The official currentBalance of one Microsoft Customer Agreement (MCA) billing profile, after the latest invoice. Shared by its subscriptions and projects, not a Foundry deployment or Quota Monitor project wallet. Only USD creditCurrency/currentBalance are accepted; no currency conversion.
How to check Azure Credits without connecting a key
- Open Azure Portal → Cost Management + Billing → Billing scopes; confirm the Microsoft Customer Agreement account and paying billing profile.
- Open Payment methods → Azure credits and read Available balance with its currency. This is after the latest invoice, not a real-time balance after all unbilled usage.
- Check expiry, eligibility, pending changes and your payment method on Azure. Review each profile separately; no secret is needed for this manual check.
Connect Microsoft Azure / Foundry to Quota Monitor
1. Confirm that your account has supported MCA Credits
Sign in to Azure Portal and search for Cost Management + Billing. Open Billing scopes and select the account paying for your Foundry resources. Check Billing account type, or Settings → Properties if only one scope is shown: it must say Microsoft Customer Agreement.
Check: choose the intended Billing profile, then Payment methods → Azure credits. Confirm USD Credits exist and note Available balance. Stop if you only have another agreement or an unsupported cloud; do not change contracts or buy Credits just to connect monitoring.
2. Copy the full billing-profile resource ID
Within Cost Management + Billing, select the target billing profile and open Properties. Copy Billing profile ID in its full resource format: /providers/Microsoft.Billing/billingAccounts/{billing-account-id}/billingProfiles/{billing-profile-id}.
Check: keep the entire path, including its account and profile segments. If you see only a short ID, ask the billing owner for the full profile resource ID. Do not paste the browser URL, /subscriptions/... path, a display name or an invoice-section ID.
3. Register a dedicated Entra application
In the billing account's directory, open Microsoft Entra ID → App registrations → New registration. Name it Quota Monitor credits, select the single-tenant account option, leave Redirect URI empty and select Register. A service principal is the app's identity; registration creates it in that tenant.
Check: from Overview copy Directory (tenant) ID and Application (client) ID. Both are UUIDs; Object ID is different. If app registration is restricted, ask your existing administrator to create this dedicated app instead of elevating your own permissions.
4. Assign the billing-profile Reader role to the app
Ask an existing Billing profile owner or Billing account owner to return to Cost Management + Billing → the target billing profile → Access control (IAM) → Add. Select Billing profile reader, find the Quota Monitor credits application by its name / Application ID, select the app and Add.
Check: the assignment is for this profile and this service principal, not your user. This is a billing role, not subscription resource IAM Reader, Cost Management Reader or an invoice-section role. Do not grant Owner/Contributor or add Microsoft Graph/model permissions. The built-in role is sufficient; no custom JSON policy is needed.
5. Create and securely save the client secret Value
Return to Microsoft Entra ID → App registrations → Quota Monitor credits → Certificates & secrets → Client secrets → New client secret. Add a monitoring-only description, choose an expiration allowed by your policy, and select Add.
Check: immediately copy the one-time Value, not Secret ID, and record its expiration privately. If the Value is lost, create a replacement and remove only the unused dedicated secret. Do not reuse an application key serving production traffic; never send secrets to an agent or online request tester.
6. Add the connection in your Quota Monitor project
Open your project → add provider connection → add new connection. Select Microsoft Azure / Foundry (MCA · USD) and a recognizable name. Fill Directory (tenant) ID and Application (client) ID from step 3, Billing profile resource ID from step 2, and Client secret Value from step 5, then save.
Check: all four fields are masked and encrypted together. There is no custom API URL, subscription filter or OAuth browser login to configure. For MCP-assisted setup, use the secure entry link; never paste the secret into chat.
7. Sync and compare the correct ledger amount
Wait for first sync or select Query latest balance. Check for a new successful query time and the MCA Credits · After last invoice label. Compare the same profile's Azure credits Available balance, not estimated remaining credit, this month's spend or a different profile.
Check: currentBalance.value of 24.5 USD displays $24.5, not cents. An updated query time does not make the post-invoice ledger real-time. Differences require checking invoice timing and credit posting, not subtracting usage again. Report only redacted amounts, time and error codes.
8. Review credit eligibility and payment on Azure
Select Open provider, return to Cost Management + Billing and re-select the exact profile. Review Azure credits and your agreement with an authorized billing administrator. Credit purchases, invoice payment and eligibility decisions remain on Azure.
Check: zero Credits can mean future usage is charged to another payment method rather than blocked. New Credits can take up to 24 hours to appear. Do not infer that all Foundry services or third-party models can spend every credit.
9. Rotate or revoke dedicated access
Before expiry, create a replacement client secret for the dedicated app, add a replacement connection and verify its sync. Remove project references to the old connection and delete it, then remove the old secret under Certificates & secrets. Plan the replacement if connection slots are full.
Check: revoking monitoring entirely also requires removing its Billing profile reader assignment in that profile's Access control (IAM). Delete only this monitoring app/secret if no longer used. Deleting a Quota Monitor connection does not revoke Azure access or affect application keys.
What Quota Monitor reads from Microsoft Azure / Foundry
- Not a real-time prepaid wallet: pending eligible charges and adjustments are not applied here. observedAt is the query time, not the invoice or settlement time. We never substitute estimatedBalance or recompute currentBalance from usage. isEstimatedBalance must explicitly be false.
- Only global commercial MCA billing-profile Credits are supported. EA, MOSP, partner/CSP accounts, separate Sponsorship portals, China and Government clouds are not supported by this connector. Having a Foundry API key or subscription ID does not establish eligibility.
- Zero Credits does not prove that Azure requests will stop: pay-as-you-go charges can continue. Credit eligibility, expiry, support and Marketplace restrictions apply; the amount does not guarantee that a particular Foundry model is covered. Never add duplicates for the same profile.
- A 204, missing amount, non-USD credit currency, estimated response or permission error is not zero. We keep the previous successful snapshot and show the failed sync. Newly added Credits can take up to 24 hours to appear according to Microsoft.
- This version uses an expiring client secret; certificates, managed identities and federated credentials are not supported yet. Microsoft recommends certificate-based credentials for stronger assurance. If your policy forbids stored secrets, use the Azure portal instead. No inference, payment, resource creation or role changes are performed by Quota Monitor.
- The dashboard shows the latest successful snapshot. Manual refresh queries the provider again but cannot eliminate upstream billing delays. An old balance is not a new result after a failed query.
Microsoft Azure / Foundry FAQ and troubleshooting
- Why do I not see MCA or the Azure credits tab?
- Check Billing account type in the selected scope's Properties and ask your billing owner whether that profile has eligible Credits. EA, MOSP, CSP/partner, separate Sponsorship and sovereign-cloud flows are outside this connector. Do not create a broad credential or buy credit to bypass this boundary.
- Why does authentication fail with 400/401?
- Check the app's Directory (tenant) ID and Application (client) ID, then Certificates & secrets for expiry or revocation. Submit Value rather than Secret ID. A Foundry API key, subscription ID, Object ID, user password or Cookie cannot replace these fields. Azure tenant policies may prohibit secret-based access.
- How do I fix 403 without administrator permissions on the app?
- An existing billing owner should inspect this profile's Access control (IAM) and verify the application has Billing profile reader. Subscription Reader or Cost Management Reader is not the same permission. Confirm the correct tenant and profile, allow the role change to propagate, and retry; never grant Owner or Global Administrator to the monitoring app.
- Why is the scope rejected or does it return 404?
- Copy the full billing-profile resource ID from Properties, with /providers/Microsoft.Billing/billingAccounts/ and /billingProfiles/ segments. It must not contain a URL host, query, subscription, invoice section or encoded path separators. Ask the billing owner to confirm it; do not select a similar-looking profile.
- Why does the amount differ, remain unchanged or return no data?
- We use only currentBalance when isEstimatedBalance=false, never estimatedBalance. The value is post-invoice; refreshes do not settle new charges. 204, missing flags/amount, unsupported currency and estimated responses fail without replacing the old amount. Compare the same profile and ledger, and allow up to 24 hours for newly added Credits.
- What about zero, 429 or revoking access?
- Zero is a valid reported ledger amount, not a guarantee that requests stop. Wait before retrying 429; do not click repeatedly. Check the last successful time after any failure. To revoke, remove the dedicated secret and its billing role in Azure; report only redacted error codes and time, never raw token responses.
Official Microsoft Azure / Foundry references
- Official reference · learn.microsoft.com/en-us/azure/cost-management-billing/manage/mca-check-azure-credits-balance(opens in a new tab)
- Official reference · learn.microsoft.com/en-us/rest/api/consumption/credits/get(opens in a new tab)
- Official reference · learn.microsoft.com/en-us/azure/cost-management-billing/manage/understand-mca-roles(opens in a new tab)
- Official reference · learn.microsoft.com/en-us/azure/cost-management-billing/automate/cost-management-api-permissions(opens in a new tab)
- Official reference · learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal(opens in a new tab)
- Official reference · learn.microsoft.com/en-us/cloud-computing/finops/toolkit/hubs/configure-scopes(opens in a new tab)
- Official reference · learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow(opens in a new tab)
- Official reference · learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc(opens in a new tab)
Prepared by Quota Monitor, not an official provider tutorial. Interfaces and permissions may change; check official pages. Verification is limited to the scope stated here.