Common questions about CloudMonitor.

Next to nothing. CloudMonitor's platform runs entirely in our Microsoft Fabric tenancy — no Fabric capacity for you to license, no Hubs deployment, no compute or managed app in your tenant. The only Azure resource you create is one storage account that receives your scheduled cost exports; CloudMonitor uses scoped access to process that cost data in a dedicated customer environment within our Fabric tenancy. The annual license covers the Fabric capacity we run for you, and your team just gets a hosted SaaS URL and a Fabric app.

CloudMonitor is an Azure-native FinOps platform. It reads your Azure billing via FOCUS, pre-builds the reports your finance and engineering teams need in a Microsoft Fabric app, and runs an optimization engine that surfaces savings recommendations.

For hyperscaler billing, CloudMonitor supports Microsoft Azure today — the platform is purpose-built for Azure FinOps — with AWS and GCP read-only support on the 2026 roadmap. It also reaches beyond the hyperscaler bill to the AI and SaaS tools your teams already run: OpenAI, Anthropic Claude, Cursor, and GitHub Copilot. That puts your AI token and per-seat spend in the same reports as your Azure cost, so you see total technology spend side by side.

CloudMonitor cannot prove AI ROI from cost data alone. It measures Azure cost and live GitHub Copilot usage; other provider views use examples until their APIs connect. ROI also needs a business outcome, the financial benefit linked to AI, total investment cost, and a credible baseline. Unit Economics can track the cost per business measure; ROI still needs attributable benefit data from the business. See FinOps for AI and ROI.

Each agent is scoped to a cost group and a governance policy. The output is always a recommendation, ticket, or runbook — your team or your existing automation makes the change. CloudMonitor itself is read-only.

Reseller mode replaces the CloudMonitor workspace logo with the partner's logo. A small Powered by CloudMonitor mark remains. Screen names, menus, documentation, and support links also keep the CloudMonitor name, so this is a branded workspace rather than a completely unbranded product. See what branding changes before presenting it to a customer.

The estimate combines core Azure spend, AI usage, and Fabric capacity. Core Azure spend uses CloudMonitor's published savings baseline, from 10% at $60K annual spend to 20% at $3M, then adjusts for your optimization stage, estate complexity, and infrastructure mix. The AI section models model right-sizing, Batch API routing, and existing provisioned-throughput right-sizing. The Fabric section uses current Azure prices for SKU right-sizing, one-year reservations, and explicit pause schedules for a separate non-production capacity. Every rate appears in the methodology section with its source and last-verified date. The result is always a range.

No. The headline savings range, the pillar breakdown, and the license comparison are free to use with no form. Your work email and company name unlock the full report: the lever-by-lever breakdown with the formula behind each number, an audit of every assumption you kept or changed, and a PDF you can share internally.

It is an estimate built from your inputs and published rates, not from your billing data. Treat it as a range, not a promise. Mature FinOps teams see smaller numbers by design because less optimization headroom remains. Connect CloudMonitor to measure spend and opportunities from your billing data. Eligibility, workload requirements, and the actions your team approves still determine realized savings.

Yes. The AI section models Azure OpenAI token spend through model mix, Batch API routing, and existing provisioned-throughput right-sizing. Prompt-caching dollars are excluded until a model version and current cache-read and cache-write rates are selected. The Fabric section models SKU right-sizing, reservations, and pause schedules for a separate pay-as-you-go non-production capacity. AI harness costs and OneLake storage are also excluded and listed beside the methodology.

Yes. Every permission CloudMonitor asks for is the minimal access needed to read your cost and usage data — read-only wherever Azure allows, scoped to the subscriptions and billing scope you choose. The only write or management access anywhere in setup is a single, tightly scoped role on the storage account that receives your cost exports, used only to create and run that export. Full detail is in the access guide.

CloudMonitor runs as a hosted SaaS platform in our Microsoft Fabric tenancy. Azure Cost Management writes raw FOCUS files to a storage account you own, where they remain. During onboarding, CloudMonitor confirms which Azure and Microsoft Fabric regions are available for the service. We deploy a dedicated customer shard in the agreed region, and Fabric stores the processed cost model and reporting data in the shard's dedicated workspace. See the current service-provider register for management-plane and supporting-service locations.

Set up a FOCUS cost export to an Azure Storage account in your tenant, then grant CloudMonitor the required scoped roles. Raw source files stay in that account. Billing and resource metadata access is read-only. One management role is limited to the export account so CloudMonitor can create and run the scheduled export. CloudMonitor reads the files through a OneLake shortcut. Fabric then builds the cost models and report data in your dedicated Microsoft Fabric workspace within our tenancy. CloudMonitor cannot read content inside your resources. See the Information Trust Center for the full data-flow detail.

Every customer gets a dedicated Microsoft Fabric workspace, and the transformed cost models and reporting data live in that workspace's own OneLake storage. The workspace is the isolation boundary, so customer reporting environments are not co-mingled. The raw FOCUS source files remain in customer-owned Azure Storage. The CloudMonitor application is scoped to your workspace and has no path to read across workspaces. Authentication and authorization are handled entirely by native Microsoft Entra ID and Fabric workspace roles; we have not built a custom identity or permissions layer on top, so access is governed by the same Microsoft security model that protects the rest of your Azure estate. Only the Entra users you authorize can reach your reporting data. See the Information Trust Center for the full posture.

No. CloudMonitor processes billing and resource metadata, its own setup data, and account profile fields used for sign-in. If you connect Fabric or AI features, it also processes Fabric capacity or AI token usage metrics. It cannot read secrets or content inside your VMs, databases, storage objects, or other workloads.

Least-privilege access scoped to the subscriptions and billing data you choose. Billing and resource metadata access is read-only, and you can revoke every role from the Azure portal. The one management-role exception is limited to the single storage account that receives your cost exports and is used only to create and run that export. CloudMonitor has no write access to your workloads or the data inside your services.

CloudMonitor's access to your cost and usage data is read-only. The one management role is limited to the storage account that receives your cost exports. CloudMonitor uses it only to create and run the scheduled Azure Cost Management export. Azure requires write access on the destination account to set up the export. That role cannot access your other resources or workload data. CloudMonitor reads the exported files with a separate read-only role. See the access guide.

The Marketplace SaaS app uses delegated User.Read during interactive sign-in to retrieve the signed-in user's own basic profile. It is not an application permission and does not provide directory-wide access to other users, mail, files, groups, or workload content. Background ingestion runs app-only and uses CloudMonitor's service principal with scoped Azure RBAC; it does not use Graph for cost ingestion.

No. CloudMonitor connects through a multi-tenant service principal that we provide and you authorize — you don't create or hand over a client secret, and no storage account access keys are shared. CloudMonitor authenticates to your storage and the Azure APIs over Microsoft Entra ID using the scoped Azure role assignments you grant, which you can revoke at any time.

Very little. CloudMonitor's cost exports are small files and Azure Data Lake storage is inexpensive, but they accumulate over time. You can cap the cost by applying an Azure Blob Storage lifecycle-management policy that automatically deletes exports older than a retention window you choose — keeping enough history for the trends you rely on. It's the only Azure resource you create for CloudMonitor.

Azure Activity Log records control-plane management operations against your subscriptions, but not reads of blob contents. To audit storage data-plane access, enable Azure Storage resource logs through diagnostic settings. Route those logs to a destination you retain. Storage resource logs are not collected until that setting exists. See Microsoft's guidance on the Azure Activity Log and auditing Blob Storage activity.

CloudMonitor is certified to ISO/IEC 27001:2022 (Information Security) and ISO 9001:2015 (Quality Management). It holds an ISO/IEC 42001 Certificate of Verification from Equal Assurance. Current assurance documents are available under NDA through the Security Pack; see the certification statement for scope and audit cadence.

CloudMonitor does not currently have a SOC 2 report. We can share our current ISO/IEC 27001 certificate and available audit material under NDA through the Security Pack. See the ISO certification statement for scope, certifying body, and audit cadence.

CloudMonitor holds an ISO/IEC 42001 Certificate of Verification from Equal Assurance. Its AI management system covers AI risk assessment, transparency, human oversight, and lifecycle controls. Ask Finn is user-initiated and works with the authorized user's question and relevant CloudMonitor cost context; see the Information Trust Center for data-handling details.

CloudMonitor supports TLS 1.2 or later, scans the app and supporting infrastructure for vulnerabilities each quarter, risk-ranks findings, and applies patches against documented targets. A second person reviews production code changes, secure coding practices cover the OWASP Top 10, and MFA protects code repositories, DNS management, and credential stores. System events are logged and reviewed, with security alerts routed for employee triage.

Yes. CloudMonitor maintains documented disaster recovery, backup and restore, and security incident response processes. The current Microsoft Marketplace compliance submission records these controls as vendor-attested. RPO and RTO targets are not published.

CloudMonitor maintains a documented incident response plan. Its systems process cost-management metadata, account profile data, service configuration, and connected-service usage metrics. Where Finn is used, they also process the submitted question, relevant cost context, generated answer, and associated audit data. CloudMonitor investigates suspected incidents and sends notices within the time required by applicable law and contract. It notifies affected customers, individuals, and authorities as required. Where CloudMonitor acts as a processor, it notifies and assists the relevant customer.

Yes — coordinate via Customer Success. We support customer-initiated penetration tests against the CloudMonitor app and admin app surfaces, subject to an agreed scope, schedule, and rules of engagement.

Yes — CloudMonitor is a Microsoft Solutions Partner with certified software for Azure. The designation confirms the platform has been technically reviewed for interoperability with Microsoft Azure and validated against Microsoft Marketplace customer-success criteria. Procurement teams can reference the Microsoft Learn overview of the designation and the Information Trust Center for CloudMonitor's ISO certifications, ISO/IEC 42001 verification, FinOps Specialty Solution, and Microsoft Solutions Partner status.

Our current Microsoft Marketplace submission records a retention period of less than 30 days for user data after account termination. This statement covers user data within that submission; it is not a blanket retention period for transformed cost models, reports, configuration, audit records, backups, or support records. Ask us through the security contact form for the retention and deletion terms that apply to your deployment. The raw FOCUS export stays in your Azure Storage account until you delete it or apply a lifecycle policy. You can revoke CloudMonitor's Azure access immediately from the Azure portal; revocation stops future access but does not delete exports or derived data already processed.

Request the current assurance documents through our security contact form. The security, privacy, or compliance option is selected automatically. We will confirm any NDA or access requirements for the available documents.

ISO/IEC 27001 and ISO 9001 follow annual surveillance and three-year recertification cycles. CloudMonitor holds ISO/IEC 42001 as a Certificate of Verification. Request the current certificates and audit status through the Security Pack.

Only your authorized team and the CloudMonitor onboarding team helping you set up. Staff access is limited and audited, and ongoing support access is used only to respond to a request.

Yes, in a limited way. For authentication and access control, CloudMonitor processes the signed-in user's user principal name, object ID, display name, email address, and tenant ID. The FOCUS export contains billing and resource metadata rather than mail, documents, or workload content. Customer-created resource names and tags may contain personal data if your organization enters it there. See what data CloudMonitor can see for the published cost-dataset schemas.

Azure FinOps is the practice of running the FinOps Foundation Framework specifically against Microsoft Azure spend. It covers four Domains — Understand Usage and Cost, Quantify Business Value, Optimize Usage and Cost, and Manage the FinOps Practice — applied to Azure billing scopes, Reservations, Savings Plans, Azure Hybrid Benefit, FOCUS exports, and Microsoft Cost Management. The 2026 Framework adds Executive Strategy Alignment and broader FinOps Scopes across SaaS, Data Centers, and AI.

Generic cloud FinOps assumes a multi-cloud abstraction layer. Azure FinOps starts from Azure-specific primitives: billing scopes (Management Group, Billing Account, Subscription, Resource Group), Cost Management exports, Microsoft Customer Agreement structure, MACC commitments, Reservation exchange policy, and Azure Hybrid Benefit. Treating these as first-class produces sharper recommendations than a tool that flattens every cloud into one schema.

The Microsoft FinOps Toolkit is an open-source set of Power BI reports, Bicep modules, PowerShell scripts, and the Hubs ingestion pattern, built by Microsoft's FinOps engineering team. It suits teams that can staff a Power BI plus data engineering effort to run it. CloudMonitor is the managed, supported platform for teams that would rather not maintain a Hubs deployment, dashboards, alerting, and role-based access themselves. Many CloudMonitor customers started on the Toolkit and moved across as the practice grew — see the side-by-side comparison for where each fits.

Reservations lock to a specific VM family and region and offer up to 72% off. Savings Plans for Compute apply to any family or region at up to 65% off. Reservations are exchangeable and partially refundable up to $50,000 per rolling 12 months; Savings Plans cannot be exchanged or canceled once purchased. The right answer is usually a layered portfolio: enable Azure Hybrid Benefit first, place Reservations on stable single-family workloads, and use Savings Plans for the broader compute baseline. CloudMonitor models all three together and tracks Coverage and Utilization across the portfolio.

Yes. Microsoft Cost Management is the native Azure tool — every Azure tenant has it, and CloudMonitor reads from the same billing data via FOCUS exports. Think of Cost Management as the floor: cost views, basic budgets, and exports. CloudMonitor adds Anomaly Management with Teams or Slack (via webhooks) alerts, role-based cost groups, Chargeback workflows, commitment portfolio analysis, FinOps Assessment scoring, and the full Framework alignment that Cost Management does not provide natively.

AHB is the highest-leverage quick win on Azure. If you hold Windows Server or SQL Server licenses with Software Assurance, AHB removes the license premium from eligible VMs — up to 40% off Windows and up to 55% off SQL — with no commitment, no restart, and a single CLI command per VM. Enable AHB on every eligible resource before evaluating any commitment instrument. CloudMonitor flags AHB-eligible resources that are still being billed at full PAYG so finance and engineering can close the gap.

FOCUS — the FinOps Open Cost and Usage Specification — is a vendor-neutral schema for billing data. Azure supports FOCUS v1.2 exports as of March 2026. Standardizing on FOCUS lets you treat Azure spend, SaaS spend, and other Technology Categories with one data model — which is the direction the 2026 Framework points. CloudMonitor ingests FOCUS exports directly and normalizes everything against the spec.

Microsoft and the FinOps Foundation each offer relevant credentials. The FinOps Foundation offers FinOps Certified Practitioner, FinOps Certified Professional, and the FOCUS Practitioner certification. Microsoft offers role-based Azure certifications (AZ-104, AZ-305) plus a FinOps on Azure training module on Microsoft Learn. None of these is branded "Azure FinOps Certification," but the FinOps Foundation credentials plus Azure operational fluency are the standard combination.

Yes. CloudMonitor gives CSP and MSP partners a partner-branded workspace, per-customer cost groups, and reports built for recurring service reviews. It supports Azure cost data from supported CSP billing scopes as well as Enterprise Agreement and Microsoft Customer Agreement scopes. The available cost, price, and reservation fields depend on the customer's agreement and billing role. See how Arraya Solutions and XContent use CloudMonitor for partner-led delivery.

Installing CloudMonitor normally takes a couple of hours. Total elapsed time depends on how quickly your Azure administrator approves the CloudMonitor application and grants the required scoped roles. After the first refresh, the FinOps Assessment gives a Crawl, Walk, Run baseline per Capability so you can plan the practice maturity path. Establishing the practice itself continues beyond technical installation.