Azure OpenAI
Connect Azure OpenAI token usage and deployment metrics to Doow.
Connect Azure OpenAI when Doow needs token usage, deployment activity, and model usage by Azure subscription, resource, and region.
What you need
- An Azure subscription with Azure OpenAI resources deployed.
- A service principal with Monitoring Reader access to the Azure OpenAI resource, resource group, or subscription scope you want Doow to read.
- The Azure Tenant ID, Client ID, and Client Secret for that service principal.
- The Azure OpenAI resource name or resource scope you want to track.
Scope the role to the usage you want
Assign Monitoring Reader at the narrowest scope that includes the Azure OpenAI resources Doow needs to report on. Doow only needs read access to Azure Monitor metrics for those resources.
Create a read-only service principal
- Go to the Azure Portal.
- Open Microsoft Entra ID, then App registrations, then New registration.
- Name the app something identifiable, such as
doow-azure-openai-read. - After creation, open Certificates & secrets, then New client secret.
- Set an expiry and copy the secret value. Azure only shows it once.
- Copy the Application (client) ID and Directory (tenant) ID from the app overview.
- Open the Azure OpenAI resource, resource group, or subscription scope Doow needs to read.
- Open Access control (IAM), then Add role assignment.
- Assign the Monitoring Reader role to the service principal.
Monitoring Reader is a built-in Azure Monitor role for reading monitoring data, including metrics, at the assigned scope. It does not grant write access to the resource.
What Doow reads
| Metric | Description |
|---|---|
ProcessedPromptTokens or InputTokens | Prompt tokens processed by deployment |
GeneratedTokens or OutputTokens | Output tokens generated by deployment |
TokenTransaction or TotalTokens | Total inference tokens where Azure reports them |
| Deployment | Azure OpenAI deployment name where Azure Monitor dimensions report it |
| Model | Model name and version where Azure Monitor dimensions report them |
| Region | The Azure region where the resource is hosted |
Doow reads Azure OpenAI metrics from Azure Monitor and aggregates them at the day level by subscription, resource, deployment, model, and region where those dimensions are available.
What Doow does not read
- The content of any prompts or completions
- Azure Storage data, Key Vault secrets, or unrelated Azure services
- Azure OpenAI deployment configuration or model settings
- Subscription billing details, invoices, or payment methods
How to connect
- Go to Company Settings, then Integrations in your Doow workspace.
- Find Azure OpenAI and select Connect.
- Enter the Tenant ID, Client ID, and Client Secret.
- Enter the Azure OpenAI resource name or resource scope.
- Select Connect.
- Wait for Doow to verify the credentials and begin the initial usage sync.
Multi-resource setups
If Azure OpenAI usage is spread across multiple resources, resource groups, or subscriptions, connect each scope that owns usage. Use one service principal only when its Monitoring Reader role assignment covers every resource Doow needs to read.
Confirm the sync worked
After connecting, open the integration detail page from Company Settings, then Integrations. A healthy cloud sync shows a connected state, a recent sync timestamp, and usage rows for the expected subscription, resource, region, deployment, or model.
If the connection succeeds but no usage appears, verify that the service principal has Monitoring Reader access at the scope where Azure OpenAI usage occurred.
Troubleshooting
Use these checks when cloud usage data is missing or incomplete:
- Confirm the credential belongs to the intended cloud account, subscription, or project.
- Confirm it can read the required monitoring, billing, or usage export data.
- Confirm the expected regions, deployments, or models have recent usage.
- Check whether the cloud provider reports usage with a delay.
- Check the integration event log for permission or sync errors.
Azure OpenAI-specific checks
| Symptom | Likely cause | Next action |
|---|---|---|
| No deployment usage appears | The service principal cannot read the Azure OpenAI resource or Azure Monitor data | Confirm the role assignment on the resource, subscription, and monitoring scope |
| Only one resource appears | The role assignment only covers one Azure OpenAI resource | Add each resource or assign Monitoring Reader at the resource group or subscription scope |
| Credentials validate but sync is empty | Usage is in another subscription, resource, or region | Confirm the resource scope, subscription, and region before reconnecting |
Disconnecting
Go to Company Settings, then Integrations, find Azure OpenAI, and select Disconnect. Doow deletes the stored credentials immediately. Remove the role assignment, delete the client secret, or delete the service principal in Microsoft Entra ID when you want to remove provider-side access too.
Next steps
After cloud usage appears, connect an identity provider if Doow needs to match Azure OpenAI usage to users and app ownership. Connect HRIS when the review needs department or employment context.