Insights: Cost, Network, Security and Compliance¶

The portal has four insight areas. All of them start from a catalog entity (workload, team, domain, organisation or subscription) and show the data for the Azure subscriptions linked to it. Four things are the same for all of them.

Data is synced in the background and stored in the portal's database, except the network log lines, which are queried on demand. A page can therefore lag behind Azure. When the portal detects stale data it shows a warning panel and results can be incomplete until the next successful sync.
Roll-ups follow the hierarchy organisation, domain, team, workload, subscription (Catalog and entity model).
Summaries are open, detail is gated. Cost, the secure score and the compliance percentage are visible to every signed-in user by default. Recommendations, policy details and firewall or WAF logs are visible only to owners of the workload (Authentication and access).
Everything has an MCP tool, so the agents and your editor can ask the same questions (MCP server).

Area	Source in Azure	Sync	Detail visible to
Cost	Azure Cost Management exports (FOCUS, Parquet), loaded with Azure Data Factory into Azure SQL	Export by Azure, ingestion once a day	All signed-in users (default)
Network	Azure Firewall and Application Gateway diagnostics in Log Analytics	Inventory every 10 minutes (default); logs on demand	Owners of the workload
Security	Microsoft Defender for Cloud (secure score, assessments) through Azure Resource Graph	Hourly (default)	Owners, for recommendations. Score for all.
Compliance	Azure Policy regulatory compliance initiatives through Azure Resource Graph	Hourly (default)	Owners, for policy detail. Percentages for all.

The sync intervals are defaults of the shared configuration; the platform team can change them (Configuration).

Cost¶

Cost insights shows Azure spend per month, with history, for subscriptions, workloads, teams and domains.

Views¶

Entity	What the page shows
Workload	All subscriptions of the workload, each as its own entry. Useful to compare environments such as development, test and production.
Team (group)	The workloads the team owns (through the `ownerOf` relation), each as the sum of its subscriptions
Domain	The workloads of the domain (through `hasPart`), and per team that owns workloads in it

The charts can group by subscription, workload or group (team). Costs that cannot be attributed to an owner are shown as UNKNOWN, drawn last with a striped pattern. The colours are derived from the active theme of the environment, so there is no per-customer colour list to maintain.

Data flow¶

flowchart LR
    azure["Azure Cost Management"] -->|"scheduled FOCUS export<br/>Parquet, Snappy"| lake["Storage account<br/>billingdata container"]
    lake --> adf["Azure Data Factory<br/>daily pipeline"]
    adf --> sql["Azure SQL database<br/>billing table and views"]
    portal["Portal backend"] -->|"queries"| sql
    portal -->|"creates exports<br/>through the managed identity"| azure

The portal itself creates and maintains the exports: a scheduled task discovers the in-scope subscriptions and creates one month-to-date export per subscription, in batches, inside an off-hours window. See Cost insights setup.
Exports use the FOCUS schema, in Parquet with Snappy compression. This gives actual and amortised cost in one export on an open standard.
The Data Factory pipeline runs daily (04:00, W. Europe time in the reference code) and loads the data incrementally into SQL.

What to expect¶

After a new setup, Azure usually creates the first export within 24 hours and the nightly ingestion follows. Cost data can take one to two days to appear. A platform engineer can start exports and ingestion by hand.
A subscription whose Microsoft.CostManagement resource provider is not registered is skipped and retried on the next run.
The default scope is every subscription the portal's managed identity can see. It can be narrowed to management groups.

Cost data is not gated by default. A customer can ask for a stricter setting; the access model supports it (Authentication and access).

Network¶

The network view is a card on the Network tab of a workload. It shows, for a selectable time range (default one day):

Firewall blocked requests: requests denied by Azure Firewall. Network, application, NAT, threat intelligence and IDPS log tables are read; both the resource-specific tables and the legacy AzureDiagnostics format are supported.
Application Gateway logs: WAF events and access logs.

Status of a WAF request¶

Status	Meaning
`Blocked`	The WAF blocked the request
`Matched`	The request added to the anomaly score, but was not blocked
`Detected`	The WAF ran in detection mode and would have blocked the request in prevention mode
`Allowed`	The WAF passed the request without a rule match

The switch "Show blocked and flagged only" hides Allowed requests.

How requests are matched to a workload¶

Log	A request belongs to the workload when
Azure Firewall	its source or destination IP is inside an address prefix of a virtual network in the workload's subscriptions. Only denied requests are shown.
Application Gateway	its source IP is inside such a prefix, or its host name (and optional path prefix) matches an external URI of the workload

Traffic from the internet to a WAF-protected application rarely comes from the workload's own network, so the external-uris tag is what scopes internet-facing traffic. Host names are matched case-insensitively. A URI without a path matches every path on that host. A URI with a path matches requests whose request URI starts with that path.

Data freshness¶

The inventory of firewalls, Application Gateways and virtual networks is refreshed in the background (default every ten minutes). The log lines themselves are queried from the Log Analytics workspace when the page is opened. The portal's identity therefore needs Reader and Monitoring Reader on the scopes where the firewalls and gateways live (Prerequisites).

To query the gateway logs yourself with KQL, see Application Gateway logs.

Security¶

Security insights shows the Microsoft Defender for Cloud secure score of the selected entity and the recommendations behind it.

A subscription score comes straight from Defender for Cloud.
A workload, team or domain score is the average secure score of its subscriptions. It is not an all-or-nothing status.
The page can group by workload, domain, team or subscription.
Recommendations are the unhealthy assessments, grouped in the page by recommendation or by resource, with a link to the Azure portal to remediate. Container image assessments are left out because they repeat the same finding for every resource the image runs on. Recommendations are visible only to owners of the workload.

The subscription needs Defender for Cloud with a secure score. A subscription without one shows a score of zero.

Compliance¶

Compliance insights shows the status of regulatory compliance standards: policy initiatives of the category Regulatory Compliance, and the Microsoft cloud security benchmark. Each cell of the matrix is one standard for one scope and shows passed against total policy details.

Rule	Meaning
A scope is compliant only at 100%	If one required policy detail fails in a scope, the scope is not compliant for that standard
The rule rolls up	If any child scope is not compliant, the parent scope is not compliant either
Drill-down	The list of policy details is available per subscription, and only for owners of the workload

The data comes from Azure Policy states: assignments of the standards, and the compliance state of every resource per policy definition. A standard that is not assigned to the subscription does not appear. See Policies and exemptions for how policies and exemptions work on the platform.

Prerequisites per area¶

Area	Needs
Cost	Cost insights resources, `Cost Management Contributor` for the portal identity, `Microsoft.CostManagement` registered per subscription
Network	Diagnostics of Azure Firewall and Application Gateway to a Log Analytics workspace, `Reader` and `Monitoring Reader` for the portal identity, virtual networks in the workload subscriptions, `external-uris` tags for internet-facing traffic
Security	Microsoft Defender for Cloud on the subscriptions, `Reader` for the portal identity
Compliance	Regulatory compliance initiatives assigned with Azure Policy, `Reader` for the portal identity

The role assignments are in Prerequisites.