Automated Savings

Your Azure connection reads and never writes. When you want LevelFour to apply a saving for you, you grant write access for that one batch, on its resources and nothing wider, by running one command in Azure Cloud Shell. LevelFour applies the change and then removes the access it was given.

Ask your LevelFour contact to turn on Automated Savings for Azure for your organization. Until then, every Azure saving offers Manual Setup, which shows the change to make yourself.

What LevelFour can apply

Saving	What LevelFour does	What the grant allows
Unattached managed disk	Deletes the disk	`Microsoft.Compute/disks/read` and `delete`
Unused public IP address	Deletes the address	`Microsoft.Network/publicIPAddresses/read` and `delete`
Snapshot older than 90 days	Deletes the snapshot	`Microsoft.Compute/snapshots/read` and `delete`
Virtual machine stopped but still allocated	Deallocates it, which stops the compute charge	`Microsoft.Compute/virtualMachines/read`, `instanceView/read` and `deallocate/action`
Idle virtual machine	Deallocates it	The same as above
Idle SQL database	Nothing: Manual Setup only	None
Reservation purchase or renewal	Buys it, once an organization admin releases it	The built-in Reservation Purchaser role on the subscription it bills to
Savings plan purchase or renewal	Buys it, once an organization admin releases it	The built-in Savings plan Purchaser role on the subscription it bills to

An Azure SQL database cannot be stopped, so LevelFour leaves an idle one for you to decide on. Commitments covers buying and renewing.

Approve and grant

Approve the savings

Accept the savings in LevelFour and choose Automated Savings as the way to apply it. LevelFour shows a command for that batch.

Run the command in Azure Cloud Shell

Run it in Azure Cloud Shell as someone who can assign roles on those resources, such as an Owner of their subscription. The command:

Creates or updates a custom role named LevelFour Savings followed by the kind of savings, holding only the actions the table above lists for it.
Assigns that role to the LevelFour service principal on each resource in the batch, and on nothing wider. For a purchase it assigns the built-in purchaser role on the subscription instead, since Azure buys only for a holder of that role.
Assigns Role Based Access Control Administrator on the same resources, with a condition that lets LevelFour delete only its own role assignments and create none. That is what lets LevelFour remove its access afterwards.
Reports what it assigned to LevelFour.

LevelFour applies the change

LevelFour checks the permissions with Azure itself before acting, so a grant that did not land changes nothing. It reads each resource again first and skips any that no longer qualifies, such as a disk someone attached in the meantime. Then it makes the change, waits until Azure reports it done, and removes both of its role assignments on that resource.

For a purchase, LevelFour asks Azure for the price again first, and does not buy if it rose more than 2% above the price an admin accepted. LevelFour then removes both of its role assignments on the subscription.

A grant for a saving expires 72 hours after LevelFour issues the command. Commitments covers how long a purchase or renewal grant lasts. An expired grant is never used. If a batch was not applied by then, LevelFour removes its role assignments at that point.

Confirming it worked

The savings moves to Optimized, and its Status & Logs step lists each command LevelFour ran and what Azure reported, including the removal of its access. In the Azure portal, the resource's Access control (IAM), or the subscription's for a purchase, no longer lists LevelFour.

Removing access

LevelFour removes its own access, after the change and at the 72 hour deadline. You need to act in four cases:

Azure refused the removal.
The connection's secret no longer signs in, because it expired or was replaced.
The removal kept failing for a week.
The Azure connection was removed before the grant expired.

LevelFour then shows the command that deletes those role assignments and no others. It appears under the expired grant in the savings' Implementation step, and in its Status & Logs step when the removal right after a change failed. Run it in Azure Cloud Shell.

If neither step shows the command any more, this lists and deletes every grant role assignment LevelFour still holds, in each subscription you can see. --all only reads the current subscription, so the loop names each one:

APP_ID="$(az ad app list --display-name LevelFour --query '[0].appId' -o tsv)"
for s in $(az account list --query '[].id' -o tsv); do
  az role assignment list --assignee "$APP_ID" --all --subscription "$s" \
    --query "[?starts_with(roleDefinitionName, 'LevelFour Savings') || roleDefinitionName == 'Role Based Access Control Administrator' || roleDefinitionName == 'Reservation Purchaser' || roleDefinitionName == 'Savings plan Purchaser'].id" -o tsv |
    xargs -r -n 1 az role assignment delete --ids
done

This leaves the read roles from the connect command in place.

Troubleshooting

The command reports a role it could not create or assign. The person who ran it cannot assign roles on those resources. Run it as an Owner of their subscription.

LevelFour shows a command to remove its access. LevelFour could not remove the access itself. Run the command it shows, as Removing access describes.

The savings waits on its grant after the command finished. Azure can take a few minutes to apply new role assignments. LevelFour keeps checking until the grant expires.

The savings failed because the resource no longer qualifies. Someone changed the resource after LevelFour found it. LevelFour made no change. The next scan updates or retires the savings.

Connect Azure covers the read-only service principal that every grant builds on
Commitments covers buying a reservation or savings plan through LevelFour