CoverOps on Azure
Read-only through a service principal with three built-in reader roles on your subscription. CoverOps finds and prices the waste; your team applies the fixes it describes.
The access you give
A service principal with built-in reader roles.
- Reader, Cost Management Reader and Monitoring Reader on the subscription, and nothing else: no role in the set can change a resource
- Created with an az CLI script or Terraform from the console
The service principal's secret is encrypted at rest (AES-256-GCM) and used only by scans.
What it reads
- Virtual machines and their disks, snapshots, public IPs, networking, databases, storage accounts, AKS clusters and serverless apps
- Azure Monitor utilisation
- Cost Management for the billed cost
Never read: your application data, database contents or the files in your storage.
Where the rupee figures come from
Billed cost from Cost Management; resources it cannot price are shown at public list prices, labelled as estimates.
What it finds
- Idle and oversized virtual machines and databases
- Unattached managed disks, old snapshots and unused public IPs
- Storage and networking that cost money without carrying load
What it changes
Advice only on Azure: each finding comes with the exact az CLI or Terraform change and how to undo it. CoverOps never asks for a write role here.
How to connect
- Sign up and open Cloud accounts → Connect Azure
- Run the generated az CLI script (or Terraform): it creates the service principal and assigns the three reader roles
- Paste the values the script prints, press Verify access, then Connect
How to end it
Delete the service principal, or remove its role assignments on the subscription. Access ends at once. Your workloads keep running: none of them ever ran on CoverOps. More in revoking access and the security overview.
Other clouds: AWS · Google Cloud · DigitalOcean · Oracle Cloud