Microsoft Architecture
Reference architecture for multi-cloud FinOps intelligence
Microsoft-anchored control plane over a genuinely multi-cloud estate: Azure, AWS and Google Cloud cost telemetry lands in Fabric, agents reason in Azure AI Foundry, and governance runs through Entra ID, Purview and Agent365.
Experience Layer
Microsoft TeamsCopilot StudioPower Apps / React portalPower BI dashboard
Agent Layer
Azure AI FoundryAzure OpenAISemantic KernelMulti-agent orchestration
Data Layer
Microsoft FabricOneLakeFinOps hubsAzure Data ExplorerData FactoryPower BI semantic model
Provider FinOps APIs
AWS Cost Explorer APIAWS CUR 2.0 (S3 / Athena)AWS Trusted AdvisorAWS Compute OptimizerAzure Cost Management & Billing APIAzure AdvisorGoogle Cloud Billing Reports / BigQuery exportGoogle Cloud Recommender APIGCP Cost Optimization HubOCI Cost AnalysisOCI Cost & Usage ReportsOCI Budget Alerts
Cloud Cost Sources
Azure Cost Management exportsAWS Cost and Usage ReportsGoogle Cloud Billing export to BigQueryOCI object storage cost reportsKubernetes telemetryCMDB and application inventoryBusiness unit and product metadata
Governance Layer
Microsoft Entra IDMicrosoft PurviewDefender for CloudAgent365 governance layerPolicy enforcementAudit trailsApproval workflowsOwner assignmentLifecycle management
Business Value Layer
Unit economicsCloud cost forecastingAI spend attributionROI dashboardsShowback and chargebackExecutive recommendations
Native cost-management system integrations
Read-only API reach-outs into the customer's existing FinOps tooling across Azure, AWS, Google Cloud and OCI
| Provider | System | API / interface | Cadence | What it feeds | Consuming agents |
|---|---|---|---|---|---|
| Azure | Azure Cost Management & Billing | GET /providers/Microsoft.CostManagement/query (2024-08-01) | Hourly amortized pull + daily export to OneLake | Actual and amortized cost, reservation and savings plan utilization, MACC burn-down. | Ingestion AgentForecasting AgentCommitment Agent |
| Azure | Azure Advisor | GET /providers/Microsoft.Advisor/recommendations?$filter=Category eq 'Cost' | Daily | Rightsizing, idle resource and reservation purchase recommendations with impact scoring. | Waste Detection AgentOptimization Agent |
| AWS | AWS Cost Explorer | ce:GetCostAndUsage, ce:GetSavingsPlansUtilization, ce:GetAnomalies | Hourly granularity, 4x daily pull | Trend, anomaly and Savings Plan/RI coverage analysis for the AWS estate. | Ingestion AgentComparison AgentForecasting Agent |
| AWS | Cost and Usage Report (CUR 2.0) | S3 Parquet export queried via Athena / Fabric shortcut | Daily, resource-level | Line-item ground truth for allocation, tag coverage and chargeback. | Ingestion AgentUnit Economics Agent |
| AWS | AWS Trusted Advisor | support:DescribeTrustedAdvisorCheckResult (cost optimization pillar) | Daily | Idle load balancers, unattached volumes, low-utilization instances, RI coverage gaps. | Waste Detection AgentGovernance Agent |
| AWS | AWS Compute Optimizer | compute-optimizer:GetEC2InstanceRecommendations / GetEBSVolumeRecommendations | Daily | ML-based rightsizing for EC2, EBS, Lambda and ECS with projected savings. | Workload Fit AgentOptimization Agent |
| Google Cloud | Cloud Billing Reports / BigQuery export | cloudbilling.googleapis.com + BigQuery detailed usage export | Streaming export, hourly materialization | SKU-level cost, CUD coverage and project-level allocation. | Ingestion AgentComparison Agent |
| Google Cloud | Recommender API | recommender.googleapis.com/v1/.../recommendations (cost insights) | Daily | Idle VM, idle disk, CUD purchase and BigQuery slot recommendations. | Waste Detection AgentOptimization Agent |
| Google Cloud | Cost Optimization Hub | Optimization Hub aggregated recommendations export | Daily | Portfolio-level, deduplicated savings opportunities with priority ranking. | Optimization AgentExecutive Briefing Agent |
| OCI | OCI Cost Analysis | usageapi:RequestSummarizedUsages | Daily | Compartment-level cost for legacy telco billing and Exadata estates. | Ingestion AgentUnit Economics Agent |
| OCI | OCI Cost & Usage Reports | Object Storage cost-report bucket (CSV) via OCI CLI / SDK | Daily | Resource-level usage detail for allocation and commitment tracking (Universal Credits). | Ingestion AgentCommitment Agent |
| OCI | OCI Budget Alerts | budgets:ListBudgets / ListAlertRules + Notifications topic | Event-driven | Threshold breach signals fed into forecast variance and governance workflow. | Forecasting AgentGovernance Agent |
- Read-only, least-privilege identities: Entra ID workload identity federation to AWS IAM roles, GCP service accounts and OCI dynamic groups — no long-lived keys.
- All provider responses are normalized to a FOCUS-aligned schema in Fabric before an agent sees them; agents never call a provider API ad hoc without an orchestrator-issued scope token.
- Recommendation feeds (Advisor, Trusted Advisor, Compute Optimizer, Recommender, Optimization Hub) are deduplicated against internal findings so a single saving is never counted twice.
- Every outbound API call is logged with agent id, scope, latency and record count in the Agent365 audit trail.
Data flow
Daily normalized ingest
- 1.Connectors pull Azure Cost Management & Billing, AWS Cost Explorer + CUR 2.0, GCP Billing Reports and OCI Cost & Usage Reports into OneLake.
- 2.Recommendation APIs — Azure Advisor, AWS Trusted Advisor and Compute Optimizer, GCP Recommender and Cost Optimization Hub — are pulled daily and deduplicated.
- 3.Data Factory normalizes to a FOCUS-aligned schema in FinOps hubs.
- 4.Azure Data Explorer holds high-cardinality Kubernetes and telemetry data.
- 5.Power BI semantic model serves showback, chargeback and unit economics.
- 6.Agents query the semantic layer and the normalized recommendation store; direct provider calls are scoped, read-only and audited.
Agent orchestration
Azure AI Foundry + Semantic Kernel
A supervisor agent decomposes the executive question, dispatches specialist agents in parallel with scoped tool permissions, reconciles conflicting findings, and hands a structured result set to the Executive Briefing Agent. Each hop is traced, costed and written to the audit log.
Security and compliance
Zero standing access
Entra ID workload identities scope every agent to least privilege. Purview classifies and labels cost and business metadata. Defender for Cloud monitors posture across all three providers. No customer or subscriber PII enters the FinOps data estate.