Architecture and data flow fabric

CloudMonitor runs as a managed SaaS on Microsoft Fabric in our own Azure tenancy. You create one dedicated storage account for the raw FOCUS export, but there is no customer-side compute or Fabric capacity to deploy. CloudMonitor uses scoped, least-privilege access to process the cost data in a dedicated customer environment within our tenancy, then turns it into FinOps reports for your team.

Azure Cost Management writes the raw FOCUS export to your storage account. CloudMonitor processes the cost data in our Microsoft Fabric tenancy using scoped, least-privilege access, then serves the CloudMonitor apps and Ask Finn from the same governed cost model.

How the data flows

The flow has three parts: your tenancy produces the data, our Fabric SaaS reads and transforms it, and your people consume the reports.

1. Azure Cost Management writes a scheduled export. You set up one Azure Cost Management export that writes your cost and usage data — in the open FOCUS 1.2-preview format, as Parquet — into a storage account in your tenancy.
2. The export lands in a storage account you own. It sits in a dedicated resource group, in an ADLS Gen2 storage account with hierarchical namespace enabled. This account exists solely to receive the exports.
3. CloudMonitor connects to the export through a OneLake shortcut. Our Fabric pipeline uses a Microsoft Fabric OneLake shortcut as the source connection to your storage account.
4. Fabric transforms the data and builds your Fabric app. Inside our tenancy, Fabric pipelines model the data and the Fabric app surfaces your reports, insights, and recommendations.
5. Your people consume the reports. Your IT and FinOps team, business unit owners, and executives get the views they each need — from day-to-day optimization to board-level spend visibility.

Where your data lives

Azure Cost Management keeps writing the raw FOCUS export to the storage account you own. CloudMonitor accesses it through a OneLake shortcut and processes the cost data in a dedicated customer environment within our Fabric tenancy. The shortcut is the source connection; the transformed model and reporting data are hosted by CloudMonitor. The raw export remains available in your storage account, and you can revoke our access at any time by removing the role assignments.

No personally identifiable information

These datasets contain resource and meter identifiers, quantities, prices, dates, and your own resource tags — not names, email addresses, or any personal data. See What data CloudMonitor can see for the exact field schemas.

What you grant CloudMonitor

CloudMonitor connects through a multi-tenant service principal you authorize. Most access is read-only. The one management-role exception is limited to the dedicated cost-export storage account:

• Reader on the subscriptions or management groups you choose, so it can see service metadata and costs — but not change resources or read the data inside your services.
• Read-only billing access (or a cost-data role at the subscription scope) so it can read your cost and usage records.
• Storage Account Contributor on the one export storage account only — Azure requires this so the scheduled export can write your cost files there. It gives no access to your other resources.

The full step-by-step is in the access guide.

Related

• Granting CloudMonitor access to your Azure environment — the setup steps for everything shown above.
• What data CloudMonitor can see — the exact Azure Cost Management datasets and their Microsoft-published field schemas.