Archera uses an app registration created inside your Azure account to read the Cost and Usage data. The app registration requires access to minimal roles needed to create and read Cost Usage exports.

The app registration is assigned access at Tenant Root Group level as providing access at Tenant Root Group level allows Archera to read resources across all the Subscriptions inside that tenant.

Archera is only concerned with creating (one-time) and reading Cost Exports. We will not be creating any unnecessary resources inside your Azure account.