Azure Portal
Use Azure Portal and Microsoft Entra admin center to keep Resource Lens access limited to the subscriptions selected for cost analysis.
Setup checklist
- Confirm the Resource Lens enterprise application and requested tenant consent.
- Select management groups or subscriptions in Resource Lens and assign Reader at the intended scopes.
- Optionally assign Cost Management Reader, Monitoring Reader, or Advisor Reviews Reader for richer recommendation evidence.
- Return to Resource Lens and run access validation.
Best practices
- Start with a small selected subscription scope.
- Use only the optional permissions needed for the evaluation.
- Use Resource Lens settings to grant or revoke roles per subscription and review role assignments regularly in Azure.