Data Access & Azure Permissions
Connecting CostGuard to your Azure environment requires granting read access to cost and subscription data. This page explains exactly what access is used, what data is read, what CostGuard does not touch, and how you stay in control at all times.
1. Why CostGuard asks to connect Azure
CostGuard needs a connection to your Azure environment to discover the subscriptions you want to monitor, import cost and usage data from Azure Cost Management, calculate daily and service-level summaries, and generate the recommendations, forecasts, and reports that make up the product. Without this connection, CostGuard has no cost data to work with and cannot provide any insights.
2. What access is used for
The access CostGuard requests is designed to be used solely for reading cost and subscription metadata on your behalf. It is not used to modify your Azure resources, deploy workloads, access application secrets, or perform any action that changes the state of your Azure environment. We aim to use the narrowest access scope that still allows the product to function.
3. What data CostGuard reads
CostGuard is designed to read the following types of data from your Azure environment: subscription metadata needed for display and selection, cost and usage data from Azure Cost Management (amounts, meters, resource groups, service names, and time periods), and service or resource grouping information required to produce analytics and breakdowns. We do not read application code, database contents, secrets from your workloads, or configuration values from your Azure resources.
4. What CostGuard does not change
For the current version of CostGuard, the product does not need and is not designed to use broad write access to your Azure resources. CostGuard does not create or delete your Azure resources, modify your resource configurations, access secrets or certificates in your workloads, read your application source code, or connect to your production databases. If you see a permission request that goes beyond read access to cost data and subscription metadata, please contact us before granting it.
5. Least-privilege permissions
We aim to follow a least-privilege approach when asking for Azure permissions. You should grant the minimum practical permission level that allows CostGuard to read cost data — read-only access to Azure Cost Management data is preferred where possible. You can review and adjust the permissions granted to CostGuard at any time through the Azure portal, and you can revoke access entirely at any time.
6. Permission and sync states
CostGuard tracks the state of each connected subscription. The states you may see include: Connected (access is active and cost data is being synced), Pending verification (the connection has been added but access has not yet been confirmed), Permission missing (the required read permission is not present or has been removed), Sync failed (a recent attempt to import cost data encountered an error), and Disabled or revoked (you or an Azure administrator has removed the connection or permission). Customer-facing state messages are designed to be plain-language summaries and do not expose raw Azure provider errors or internal identifiers.
7. How to revoke access
You can remove CostGuard's access to your Azure environment at any time. From within CostGuard, you can disconnect a subscription. To revoke the underlying Azure permission independently of CostGuard, remove the role assignment or app registration consent in the Azure portal. CostGuard will detect that access has been revoked on the next sync attempt and will update the connection state accordingly. CostGuard has no self-service account deletion today; to request removal of data already collected, use the Contact page. You can also contact us if you need help removing access.
8. Safe errors and support
When an error occurs while accessing Azure on your behalf, CostGuard is designed to surface a plain-language summary to you rather than the raw provider error. Stack traces, internal resource identifiers, tokens, and raw Azure API responses are not intended to appear in the product UI. If you encounter an error that reveals internal details, please report it to us through the Contact page so we can address it promptly.
9. Related security and privacy pages
For more information about how CostGuard handles your data and applies security controls more broadly, see our Security overview and Privacy Policy pages. Security overview · Privacy Policy
10. Contact us
If you have questions about what data CostGuard accesses, want to understand the permissions required for your setup, or have concerns about a permission request, please contact us through our Contact page. We will respond as promptly as possible.