At a Subscription and Resource Group level, we only are able to see the Managed Resource Group containing our CloudMonitor IP. This is made up of 120+ Azure services that process your raw cost and service metadata into recommendations and useful analytics. We do not have access to any other Resource Groups or internal systems on your cloud estate. The Service Principal that you provide has READER RBAC access to extract costs and resource metadata (it cannot read the data inside the resources, e.g. on SQL Databases or Storage Account data) – we use these APIs to build up the Resource Graph of your system and the associated costs. Read a 3rd-party Cyber Security Experts’ attestation on how the CloudMonitor deployment model works.