Before you begin

Before adding an account, make sure that you have the following details:

• Account Information - You must have the tenant ID or domain name of the tenant that contains your Azure or Office 365 subscriptions. The tenant ID and domain name are available in your Azure account. For information on how to find these details, see Find IDs and domain names in the Microsoft documentation.

• Permissions - You must have sufficient permissions to complete the onboarding process. The setup will fail if the permissions are not configured in the Microsoft Azure Portal.

  • For an Azure account, you must have owner permission for the subscription you want to add.

  • For an Office 365 account, you must be a Global Administrator of the tenant that contains the subscriptions.

Activate your cloud account

Follow these steps to add a new cloud account to the Client Portal:

1. Navigate to the Cloud Tenant Setup page and click Add Cloud Account.

2. On the Add Cloud Account page, click Azure and provide the following details:

   1. Friendly Name - Provide a name for your Microsoft tenant.

   2. Microsoft Tenant ID or Tenant Domain - Provide the tenant ID or domain.

   3. License Model - Select the license model (Enterprise Agreement or Microsoft Customer Agreement).

   4. Enrollment Number - Provide the enrollment number. Note that this field is displayed only if you select Enterprise Agreement as your license model.

3. Click Add Cloud Account.

4. Sign in to the Microsoft portal using the credentials of a user who has Owner permissions to the Azure subscriptions you want to add.

1. On the consent page, review the permissions required by the Client Portal and click Accept to grant consent.

After clicking Accept, you'll be redirected to the Cloud Tenant Setup details page to view the new tenant and its activation progress. After activating your tenant, you can add subscriptions and allow the Client Portal to write tags back to your Azure resources.

When you return to the Client Portal, you might see a blank page for a few seconds. To learn about the process that takes place after you provide consent, see What happens after I grant consent.

Add more Azure subscriptions

Many organizations have several Azure subscriptions in a single Microsoft tenant. In some cases, it's not always the same person who has Owner permissions on all those subscriptions. In such cases, each subscription owner must activate their own subscriptions.

Follow these steps to add more subscriptions:

1. On the Cloud Tenant Setup page, click Manage and then select Add Existing Subscriptions to add more subscriptions.

2. In Add New Subscription, select the type of subscription and click Add.

   • If you select Azure, the user performing consent must be the Owner of the Azure subscriptions being added.

   • If you select Office 365, the user performing the consent must be a Global Administrator of the tenant.

3. Sign in to the Microsoft portal using the credentials of the user with Owner permissions to the Azure subscriptions you want to add.

4. On the consent page, review the permissions and click Accept to grant consent. After granting consent, you'll be redirected to the Client Portal.

Sync your tags to Azure

When you activate your Azure subscriptions for the first time, the Client Portal assigns the Reader role by default. This means that the Tags and Resources feature can import your resources and tags from Azure, but it cannot synchronize any tag changes you make in the Client Portal back to Azure.

For Tags and Resources to synchronize tags back to Azure, you must change the level of access the Client Portal has for your Azure subscription.

Follow these steps to change the level of access:

1. On the Cloud Tenant Setup page, click Manage.

2. Click Change Access for the subscription you want to modify.

3. Select one of the following access levels and click Change:

   • Sync resources only, no tags – write back of tags disabled - Tags and Resources will download your resources to the Client Portal without the tags currently assigned in Azure. Any changes to tags will be stored in the Client Portal only. This setting requires the “Reader” role in your Azure subscription and will not make any changes to resources or tags in your Azure subscription.

   • Sync resources and tags – write back of tags disabled - Tags and Resources will download your resources, including the tags currently assigned in Azure. Any changes to tags will be stored in the Client Portal only. Any tags assigned to resources in Azure will overwrite the tags for the corresponding resource in the Client Portal. This setting requires the Reader role in your Azure subscription and will not make any changes to resources or tags in your Azure subscription.

   • Sync resources and tags – write back of tags enabled - Tags and Resources will download your resources to the Client Portal including the tags currently assigned in Azure. Any changes to tags will be synchronized back to your resources in Azure. This setting requires the “Tag Contributor” role in your Azure subscription and will only make changes to tags.

4. Sign in to the Microsoft portal using the credentials of the user with Owner permissions to the Azure subscriptions for which you wish to modify the access level.

5. On the consent page, review the permissions and click Accept to grant consent. After granting consent, you'll be redirected to the Client Portal to view the updated access level. If you notice a blank screen, refresh the page.

In some cases, you must configure your Azure subscription manually so that the Client Portal can access the resources and tags.

How does it work?

When you onboard your tenant to the Client Portal, an Enterprise Application called PyraCloud (Azure) is created in your tenant. You must then assign the and roles to the PyraCloud (Azure) Enterprise Application.

These roles allow the Client Portal to read a list of all the resources in your Azure subscription, and read and write tags on those resources. You can control whether you want the Client Portal to write tags back to resources in your Azure subscription using the Cloud Tenant Setup feature.

Grant access to individual subscriptions

Follow these steps to grant access:

1. Launch the and search for Subscriptions.

2. On the Subscriptions page, choose the subscription you want to integrate with the Client Portal.

1. Select Access control (IAM).

1. Select the Role assignments tab.

1. Click Add > Add role assignment.

1. Select Reader from the Role menu and then search for Pyra. Choose PyraCloud (Azure) and click Save.

1. Select Tag Contributor from the Role menu and then search for Pyra. Choose PyraCloud (Azure) and select Save.

The access is granted.

The Client Portal supports both legacy Enterprise Agreement and modern Microsoft Customer Agreement models. If you are adding an EA or MPSA account, see Activating an Azure EA or MPSA account.

Before you begin

Before adding an account, note the following points:

• Make sure you've followed the steps in Activating your account.

• Make sure your account has the proper billing account type set up. To verify this, launch the Azure Portal. From the left navigation pane, select Cost Management + Billing. Then, navigate to Settings > Properties. The account type is displayed in the right pane.

Assign the Billing Account Reader role (Azure Portal)

Follow these steps to assign the Billing account reader role to the Client Portal:

1. Sign in to the Azure Portal and search for Cost Management + Billing.

2. In the left navigation pane, select Billing scopes and then select your MCA billing scope.

1. Select Access Control (IAM) to assign permissions.

1. Select Add and then from the Role dropdown list, select Billing account reader.

1. Select the PyraCloud (Azure) application.

2. Select Save. Your MCA billing data will be synchronized with the Client Portal after 24 hours.

If you purchased SoftwareOne's Digital Workplace Essentials/365Simple, and Azure Essentials/ AzureSimple services, you must activate your cloud account in the Marketplace Platform.

Cloud accounts that require activation are displayed on the Cloud tenant setup page and have the Activation Required status and links to activate Microsoft 365 and Microsoft Azure, depending on the service you purchased.

This topic describes how you can access the Cloud tenant setup page and complete the activation.

Activate Microsoft 365

Follow these steps to activate Microsoft 365:

1. Navigate to the Cloud tenant setup using one of the following steps:

   • Click this link: Cloud tenant setup.

   • Sign in to the platform. Next, open the main menu and go to Cloud tools > Cloud tenant setup.

2. On the Cloud tenant setup page, locate the account that needs activation. The status will be Activation Required.

3. In the Actions column, click Activate Microsoft 365.

1. On the Microsoft sign-in page, enter your username and password. Note that you must provide your Global Administrator credentials.

2. Review the permissions and click Accept to grant consent.

Activate Microsoft Azure

Follow these steps to activate Microsoft Azure:

1. Navigate to the Cloud tenant setup using one of the following steps:

   • Click this link: Cloud tenant setup.

   • Sign in to the platform. Next, open the main menu and go to Cloud tools > Cloud tenant setup.

2. On the Cloud tenant setup page, locate the account that needs activation. The status will be Activation Required.

3. In the Actions column, click Activate Microsoft Azure.

1. On the Microsoft sign-in page, enter your username and password. Note that you must have the Owner or User Access Administrator role for the account to activate.

2. Review permissions and click Accept to grant consent.

On successful validation of your credentials, your account is activated and the Cloud tenant setup page displays the activation status as Connected.

You can use Azure Management Groups to grant the Client Portal access to your Azure subscriptions. This approach has the following benefits:

• You can assign access to multiple subscriptions in a single step.

• If you create more Azure subscriptions in the future, access will be automatically granted. It means when you add an Azure subscription to your tenant, activating it in the Client Portal is unnecessary.

Grant access using Azure CLI

Use the following commands to onboard your Azure subscriptions:

The following table explains these commands:

Grant access using the Azure Portal

Before granting access through the Azure Portal, note the following points:

Step 1: Search for Management Groups

2. On the Management groups page, select Tenant Root Group. Note that regardless of your organization's configuration, you'll always have a Tenant Root Group. It might have been renamed, but it always appears at the top of the hierarchy.

Step 2: Open the Add role assignment page

1. From the left sidebar, select Access control (IAM).

1. Click Add > Add role assignment.

The Add role assignment page opens.

Step 3: Assign the Reader role

1. On the Role tab, select Reader as the role and click Next. The Member tab opens.

1. Select User, group, or service principal if it's not selected by default, and then click Select members.

1. In the Select members panel, type Pyra and then select PyraCloud (Azure) from the search results.

1. Click Select to add PyraCloud (Azure) to the Members list. Once PyraCloud (Azure) is added, click Review + assign.

2. On the Review + assign tab, review the details and click Review + assign to confirm the role assignment.

Step 4: Assign the Tag Contributor role

After you've completed the steps, the roles are assigned and displayed on the Role assignments tab.

You can integrate your Microsoft tenant with the Client Portal using the following steps:

1. Grant consent to the Client Portal in your Azure tenant.

2. Assign the Tag Contributor and Reader access roles to the Client Portal using Azure Management Groups.

3. Share the details with SoftwareOne to complete your onboarding.

The Tag Contributor and Reader roles allow the Client Portal to read a list of all the resources in your Azure subscription, and read and write tags on those resources. You can control whether you want the Client Portal to write tags back to resources in your Azure subscription. For more information, see Syncing your tags to Azure.

Grant consent through your Azure tenant

Follow these steps to grant consent through your Azure tenant:

1. Select one of the following links:

   • Azure

   • Office365

2. On the Permissions Requested page, review the permissions, and select Accept.

3. After granting consent, launch the Azure Portal and navigate to Azure Active Directory > Enterprise applications to make sure that the Client Portal/PyraCloud is listed in your enterprise applications.

Assign the Tag Contributor and Reader access roles

Follow these steps to assign the Tag Contributor and Reader access roles:

1. Launch the Azure Portal and search for Management groups.

2. On the Management groups page, select Start using management groups.

3. Provide the Group ID and a display name for your group. Select Submit. The new group will be created and displayed under the Tenant Root Group.

4. Select the newly created management group and then from the left sidebar, select Access Control (IAM).

5. Navigate to Role assignments and select Add > Add role assignment from the dropdown.

6. Assign the Reader role to the Client Portal:

   1. Choose Reader from the list of roles and select Next.

   2. On the Members tab, click Select Members, and then in the Search box, type PyraCloud.

   3. From the search results, choose PyraCloud (Azure) for Azure or PyraCloud (Office 365) for Office 365. Select Save.

7. Assign the Tag Contributor role to the Client Portal:

   1. Choose Tag Contributor from the list of roles. Select Next.

   2. On the Members tab, click on Select Members, and then in the Search box, type PyraCloud.

   3. From the search results, choose PyraCloud (Azure) for Azure or PyraCloud (Office 365) for Office 365. Select Save.

8. Select Review + assign and then Review + assign again. The new roles will be displayed on the page.

Provide the details to SoftwareOne

After you’ve completed the integration steps, provide the following details so that we can complete the onboarding of your tenant:

• Your Microsoft Tenant ID (or domain).

• A friendly name for your tenant to recognize easily across the Client Portal.

• The start and end date of your Enterprise Agreement.

After we’ve added your tenant, you will also need to provide an access token from the EA Portal. For information on how to provide an access token, see Add an Access Token.

Microsoft will retire the legacy Azure Enterprise Reporting APIs on 1 May 2024. Currently, the Client Portal uses these APIs to get your Azure EA consumption data.

If you have an Azure Enterprise Agreement (EA), you must migrate to the new Azure Cost Management APIs to maintain your cost and usage data in the Client Portal.

Before you begin

Before migrating to the new Cost Management APIs, note the following points:

• The new APIs don't require access tokens because the authorization is done through Microsoft Entra ID (also known as Azure Active Directory) using service principals.

• Only individuals with the Azure EA Enterprise Administrator role permission can carry out the migration steps. If you have trouble finding out who is your EA admin in Azure, see Microsoft's documentation on EA Billing administration on the Azure portal.

• During the consent flow, the SoftwareOne Cloud Consumption app is added to the organization tenant. This enterprise application is granted the EA Reader permission, which allows us to read the consumption data. To add the application to the tenant, you'll need permission to approve an Enterprise Application.

• If your EA admin doesn't have access to the Client Portal, you can collaborate with them by sharing your screen, so your EA admin can sign in and complete the authorization required for migration.

• During migration, our system automatically assigns the EnrollmentReader role permission to the service principal.

Migrate your existing EA cloud account

If you've already onboarded your EA cloud account to the Client Portal and have appropriate permissions to approve Enterprise Applications, follow these steps to transition to the new API:

1. Open the Cloud Tenant Setup page. EA cloud accounts that haven't been migrated will display EA API migration required in the Status column.

1. Click Migrate EA API.

2. In the Migrate to EA API window, enter the enrollment number and click Migrate.

1. Sign in to the Microsoft portal using the credentials of a user with Enterprise administrator permission.

2. On the consent page, review the permissions required by the Client Portal and click Accept to grant consent.

After clicking Accept, you'll be redirected to the Cloud Tenant Setup details page.

The system will mark the enrollment number you provided as migrated, and automatically assign the Enrollment reader permission to the PyraCloud (Azure) application. When the migration is completed, the consumption data is fetched from Microsoft.

Migrate without consent

If you cannot provide consent to approve enterprise applications or have environment restrictions, you can follow these steps to migrate and assign permissions manually:

1. On the Cloud Tenant Setup page, locate the required EA cloud account with the status EA API Migration required.

1. In the Actions column, click Migrate EA API.

2. In the Migrate to EA API window, enter the enrollment number and click Migrate without consent.

1. On the details page of the tenant, select the Enrollment Numbers tab and click Show manual steps.

2. In Manual steps, assign permissions using Cloud Shell or REST API and click Close. Note that you must have the Azure EA Enterprise Administrator role to assign permissions.

Enrollment statuses

The Enrollment Numbers tab on the details page of the cloud tenant displays the enrollment numbers that are migrated to the new API, along with the respective enrollment status:

• Connected - Indicates that the system is connected and working as expected.

• Cannot Connect - Indicates that the Client Portal doesn't have access to the new Azure Cost Management API and the EnrollmentReader permission is missing. You can assign permissions using the Azure Cost Management API or Azure Cloud Shell.

• Activation Required - Indicates that the Client Portal can access the enrollment data, but the cloud account has not been set up as an EA account type.

Add a new EA cloud account

If you're adding a new EA cloud account to the Client Portal, you'll need to provide the enrollment number while adding the account. For information on how to add a new EA account, see Activate your cloud account.

As a Global Administrator, you can manage all Azure subscriptions and management groups in your tenant by elevating your access.

When you elevate your access, you'll be assigned the User Access Administrator role in Azure at root scope (/).  This allows you to view all resources and assign access to any subscription or management group in the directory.

To elevate access, follow the instructions in Microsoft documentation: Elevate access to manage all Azure subscriptions and management groups, or perform these steps:

1. Sign in to Azure Portal as a Global Administrator.

2. Open Microsoft Entra ID. You can use the Azure search bar to find Microsoft Entra ID.

1. Under Manage, select Properties.

1. Under Access management for Azure resources, set the toggle to Yes.

1. Click Save. This will grant you permission to assign roles in all Azure subscriptions and management groups associated with this Microsoft Entra ID.

2. If required, sign out and sign back in to refresh your permissions.