Skip to main content
This article walks you through connecting your Azure AI Foundry resources to BRM to better understand and track your team’s AI spend and usage. Why this matters:_ AI spend on Azure often hides inside a much larger cloud bill. This connection gives you a clear, resource-level view of what’s actually running through Azure AI Foundry._ ⚠️ Important: This is not an Azure OpenAI or Foundry inference API key. BRM needs Microsoft Entra service-principal client credentials — a different kind of credential created in Azure’s Entra admin tools. BRM uses these credentials to read your Azure AI resources and their Cost Management spend data. It does not use them to run inference, deploy models, or read prompts/responses. ℹ️ BRM backfills up to a year of daily spend history from Azure Cost Management, broken down by Foundry resource and billing meter. Where a resource has a single model deployment, BRM attributes that spend to the model.

​
What you’ll need

You’ll end up with four values to enter into BRM:
Tenant IDYour Microsoft Entra tenant
Subscription IDThe Azure subscription containing your Foundry resources
Client IDThe app registration’s Application (client) ID
Client secretThe secret value (not the Secret ID)
Roles needed, assigned at the subscription level:
  • Reader — lets BRM list Azure resources and Foundry deployments
  • Cost Management Reader — lets BRM read Azure Cost Management spend data
Who can do this: An Azure admin who can create app registrations and assign subscription-level roles — usually a subscription Owner or User Access Administrator.

​
Step 1: Identify the right subscription

Confirm which Azure subscription contains the Azure AI Foundry resources you want BRM to track. If your Foundry resources span multiple subscriptions, repeat this setup for each one — or contact BRM support to discuss a custom setup.

​
Step 2: Create an app registration

In Azure Portal, go to Microsoft Entra ID → App registrations → New registration. Name it “BRM AI Usage”. Double-check you’re creating this in the correct Microsoft Entra tenant — the one tied to the subscription from Step 1.

​
Step 3: Copy the tenant ID and client ID

On the app’s overview page, copy the Application (client) ID and the Directory (tenant) ID. You’ll need both later.

​
Step 4: Create a client secret

Go to Certificates & secrets → Client secrets → New client secret.

​
Step 5: Copy the secret value

Copy the secret’s Value column right away — it’s only shown once. Don’t copy the Secret ID; BRM needs the Value.

​
Step 6: Assign the Reader role

Go to Subscriptions → [your subscription] → Access control (IAM) → Add role assignment. Assign the Reader role to the BRM AI Usage app.

​
Step 7: Assign the Cost Management Reader role

Repeat the role assignment, this time choosing Cost Management Reader, at the same subscription scope. ℹ️ Azure role assignments can take a few minutes to take effect. If BRM’s connection test fails right after this step, wait a few minutes and try again.

​
Step 8: Enter everything in BRM

In BRM, open the Azure AI Foundry integration setup, found by clicking on your profile in the lower-left-hand corner of the screen, navigating to Integrations, then clicking “Connect” next to “Azure Foundry”, and enter:
  • Tenant ID
  • Client ID
  • Client secret (the Value, not the Secret ID)
  • Subscription ID
BRM will confirm the connection and begin pulling in spend data.
Screenshot 2026 07 09 At 2 52 21 PM

​
If you’d rather use the command line

If your team is comfortable with Azure CLI, this whole setup can be scripted: 
AZURE_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"

az account set --subscription "$AZURE_SUBSCRIPTION_ID"

APP_ID=$(az ad app create --display-name "BRM AI Usage" --query appId -o tsv)
az ad sp create --id "$APP_ID"

# The printed value is the client secret. Copy it directly into BRM.
az ad app credential reset \
  --id "$APP_ID" \
  --append \
  --display-name "BRM AI Usage secret" \
  --years 1 \
  --query password \
  -o tsv

az role assignment create \
  --assignee "$APP_ID" \
  --role "Reader" \
  --scope "/subscriptions/$AZURE_SUBSCRIPTION_ID"

az role assignment create \
  --assignee "$APP_ID" \
  --role "Cost Management Reader" \
  --scope "/subscriptions/$AZURE_SUBSCRIPTION_ID"

az account show --query "{tenantId:tenantId, subscriptionId:id}" -o json

​
Security notes

  • Both roles are read-only. BRM cannot run inference, deploy models, change Azure resources, change billing settings, or read prompt/response content.
  • You can rotate or revoke the client secret at any time in Microsoft Entra ID. Note that revoking the secret stops BRM’s syncing until you enter a new one by reconnecting the integration in BRM.
  • If your organization manages costs at a management group, billing account, billing profile, or invoice-section level instead of per-subscription, contact BRM support before setup — this guide covers the standard subscription-level setup only.

​
Common mistakes

  • Using an Azure OpenAI or Foundry inference key instead of Entra client credentials. These are different credential types.
  • Copying the Secret ID instead of the secret Value. BRM needs the Value.
  • Creating the app registration in the wrong Microsoft Entra tenant.
  • Granting Cognitive Services permissions but forgetting subscription-level Reader and Cost Management Reader.
  • Assigning Reader but forgetting Cost Management Reader. The initial connection test will still pass — it only checks that BRM can see the subscription — but no spend data will ever arrive. If the integration connects but stays empty, check this role first.
  • Testing the connection immediately after assigning roles. Give this a few minutes — Azure role assignments take time to propagate.
  • Connecting only one subscription when Foundry resources live across several. Set up one integration per subscription, or talk to BRM support about a custom setup.

​
Provider documentation

Our steps above should stay current, but if Microsoft changes their interface, these are the source-of-truth docs:

​
Still stuck?

Reach out to BRM support and let us know which step you’re stuck on. Don’t send your client secret over email or chat — we’ll point you to a secure way to share it if needed.