Azure Cost Management — guide

Azure Cost Management turns cloud spend into mesh data. You connect a service principal that may read costs, list the Azure subscriptions you care about, and fetch a month: for every subscription the package writes one Statement — that month's actual cost, in the currency Azure reports, stamped with the day it was pulled.

It is built for teams that bill customers for the Azure capacity they consume — pass-through pricing or cost plus a markup — and for anyone who needs monthly cloud spend as data they can query, report on and link to other records.

Key concepts

• Connection (AzureCostManagement/Connection) — one service principal and the subscriptions it pulls. It holds the Entra tenant id, the app registration's client id and client secret, the subscription ids (one GUID per line) and, optionally, the month to fetch.
• Statement (AzureCostManagement/Statement) — one month of one subscription: the subscription id, the month (yyyy-MM), the cost (rounded to two decimals), the ISO currency code Azure reported, and the retrieval date. Statements are written as children of their connection.
• A statement is a snapshot. Azure restates late usage, so the figure for a month can change after the month ends. Subscription × month is a statement's identity: fetching the same month again overwrites its statement rather than adding a second one, and the retrieval date tells you how fresh the figure is.
• Nothing polls. A person clicks Fetch. The package schedules nothing and runs no background job.
• Costs are pulled in arrears. With no month set on the connection, the fetch takes the previous month in your time zone — the month your invoices cover.

Typical workflow

1. Create an app registration in Microsoft Entra ID and give its service principal the Cost Management Reader role on each subscription you want to pull. Reading costs is all it needs.
2. Create a Connection node in a partition that only your operators can read (see Security below).
3. Fill in the connection's form — tenant id, client id, client secret and the subscription ids — and save. Entries that are not GUIDs are listed as ignored, so a typo is visible before you fetch.
4. Press Fetch . The package requests a token with the client-credentials flow, asks the Azure Cost Management query API for each subscription's actual cost over that calendar month, and writes one Statement per subscription. A status line reports every outcome.
5. Re-fetch later if you want the restated figure; the statement is replaced in place.

How the figure is obtained

For each subscription the package sends one query for the month's actual cost with no daily breakdown — a single total. The cost and currency columns are read by name, never by position. A month with no usage still answers with a zero, and that zero is written as a real statement; a response that cannot be read is reported as a failure rather than recorded as zero cost.

Security

The client secret is stored in the connection node's content, so anyone who can read the node can read the secret. Keep connections in a partition only operators can read. The page's form never shows the stored secret: the secret field starts empty, and leaving it blank on Save keeps the one already stored. The page only says whether a secret is set. The secret is also kept off the generic edit grid.

Using the statements

Statements are ordinary mesh nodes, so they can be searched, listed, linked and read by other packages. The MeshWeaver CRM's consumption-priced billing plans — Azure pass-through and cost plus markup — read them by subscription id and month.

What you get

• Two node types, Connection and Statement, compiled live on your mesh.
• A connection page with a masked credentials form and a one-click monthly fetch.
• One statement per subscription and month, with its retrieval date.
• In-mesh tests for both types, runnable from each type's Tests area.