Permissions to view and manage Azure savings plans
This article explains how savings plan permissions work and how users can view and manage Azure savings plans in the Azure portal.
Who can manage a savings plan by default
There are two different authorization methods that control a user's ability to view, manage and delegate permissions to savings plans - billing admin roles and savings plan RBAC roles.
Billing admin roles
You can view, manage, and delegate permissions to savings plans using built-in billing admin roles. To learn more about MCA and EA billing roles, see Understand Microsoft Customer Agreement administrative roles in Azure and Managing Azure Enterprise Agreement roles, respectively.
Billing admin roles required for savings plan actions
- View savings plans
- MCA: Users with Billing profile reader or above
- EA: Users with Enterprise Administrator (read only) or above
- MPA: Not supported
- Manage savings plans (achieved by delegating permissions for the full billing profile/enrollment)
- MCA: Users with Billing profile contributor or above
- EA: Users with EA Administrator or above
- MPA: Not supported
- Delegate savings plan permissions
- MCA: Users with Billing profile contributor or above
- EA: Users with EA purchaser or above
- MPA: Not supported
View and manage savings plans as a billing admin
If you're a billing role user, use following steps to view and manage all savings plans and savings plan transactions in the Azure portal:
- Sign in to the Azure portal and navigate to Cost Management + Billing.
- If you're under an EA account, in the left menu, select Billing scopes and then in the list of billing scopes, select one.
- If you're under a MCA account, in the left menu, select Billing profiles. In the list of billing profiles, select one.
- In the left menu, select Products + services > Savings plans. The complete list of savings plans for your EA enrollment or MCA billing profile is shown.
- Billing role users can take ownership of a savings plan with the Savings Plan Order - Elevate REST API to give themselves Azure RBAC roles.
Adding billing administrators
Add a user as billing administrator to an Enterprise Agreement or a Microsoft Customer Agreement in the Azure portal.
- For an Enterprise Agreement, add users with the Enterprise Administrator role to view and manage all savings plan orders that apply to the Enterprise Agreement. Enterprise administrators can view and manage savings plan in Cost Management + Billing.
- Users with the Enterprise Administrator (read only) role can only view the savings plan from Cost Management + Billing.
- Department admins and account owners can't view savings plans unless they're explicitly added to them using Access control (IAM). For more information, see Manage Azure Enterprise roles.
- For a Microsoft Customer Agreement, users with the billing profile owner role or the billing profile contributor role can manage all savings plan purchases made using the billing profile.
- Billing profile readers and invoice managers can view all savings plans that are paid for with the billing profile. However, they can't make changes to savings plans. For more information, see Billing profile roles and tasks.
Savings plan RBAC roles
The savings plan lifecycle is independent of an Azure subscription. Savings plans don't inherit permissions from subscriptions after the purchase. Savings plans are a tenant-level resource with their own Azure RBAC permissions.
Overview
There are four savings plan-specific RBAC roles:
- Savings plan administrator – allows management of one or more savings plans in a tenant and delegation of RBAC roles to other users.
- Savings plan purchaser – allows purchase of savings plans with a specified subscription.
- Allows savings plans purchase or Reservation trade-in by non-billing admins and non-subscription owners.
- Savings plan purchasing by non-billing admins must be enabled. Learn more here.
- Savings plan contributor – allows management of one or more savings plans in a tenant but not delegation of RBAC roles to other users.
- Savings plan reader – allows read-only access to one or more savings plans in a tenant.
These roles can be scoped to either a specific resource entity (e.g. subscription or savings plan) or the Microsoft Entra tenant (directory). To learn more about Azure RBAC, see What is Azure role-based access control (Azure RBAC)?.
Savings plan RBAC roles required for savings plan actions
- View savings plans:
- Tenant-scope: Users with Savings plan reader or above.
- Savings plan-scope: Built-in Reader or above.
- Manage savings plans:
- Tenant-scope: Users with Savings plan contributor or above.
- Savings plan-scope: Built-in Contributor or Owner roles, or Savings plan contributor or above.
- Delegate savings plan permissions:
- Tenant-scope: User Access Administrator rights are required to grant RBAC roles to all savings plans in the tenant. To gain these rights, follow Elevate access steps.
- Savings plan-scope: Savings plan administrator or User access administrator.
In addition, users who held the Subscription owner role when the subscription was used to purchase a savings plan, can also view, manage and delegate permissions for the purchased savings plan.
View savings plans with RBAC access
If you have savings plan-specific RBAC roles (Savings plan administrator, purchaser, contributor or reader), purchased savings plans, or been added as an owner to savings plans, use the following steps to view and manage savings plans in the Azure portal:
- Sign in to the Azure portal.
- Select Home > Savings plans to list savings plans that you have access to.
Adding RBAC roles to users and groups
To learn about delegating savings plan RBAC roles, see Delegate savings plan RBAC roles
Grant access with PowerShell
Users that have owner access for savings plan orders, users with elevated access, and User Access Administrators can delegate access management for all savings plan orders they have access to.
Access granted using PowerShell isn't shown in the Azure portal. Instead, you use the get-AzRoleAssignment command in the following section to view assigned roles.
Assign the owner role for all savings plan
Use the following Azure PowerShell script to give a user Azure RBAC access to all savings plan orders in their Microsoft Entra tenant (directory).
Import-Module Az.Accounts
Import-Module Az.Resources
Connect-AzAccount -Tenant <TenantId>
$response = Invoke-AzRestMethod -Path /providers/Microsoft.BillingBenefits/savingsPlans?api-version=2022-11-01 -Method GET
$responseJSON = $response.Content | ConvertFrom-JSON
$savingsPlanObjects = $responseJSON.value
foreach ($savingsPlan in $savingsPlanObjects)
{
$savingsPlanOrderId = $savingsPlan.id.substring(0, 84)
Write-Host "Assigning Owner role assignment to "$savingsPlanOrderId
New-AzRoleAssignment -Scope $savingsPlanOrderId -ObjectId <ObjectId> -RoleDefinitionName Owner
}
When you use the PowerShell script to assign the ownership role and it runs successfully, a success message isn’t returned.
Parameters
-ObjectId Microsoft Entra ObjectId of the user, group, or service principal.
- Type: String
- Aliases: Id, PrincipalId
- Position: Named
- Default value: None
- Accept pipeline input: True
- Accept wildcard characters: False
-TenantId Tenant unique identifier.
- Type: String
- Position: 5
- Default value: None
- Accept pipeline input: False
- Accept wildcard characters: False
Add a Savings plan Administrator role at the tenant level using Azure PowerShell script
Use the following Azure PowerShell script to add a Savings plan Administrator role at the tenant level with PowerShell.
Import-Module Az.Accounts
Import-Module Az.Resources
Connect-AzAccount -Tenant <TenantId>
New-AzRoleAssignment -Scope "/providers/Microsoft.BillingBenefits" -PrincipalId <ObjectId> -RoleDefinitionName "Savings plan Administrator"
Parameters
-ObjectId Microsoft Entra ObjectId of the user, group, or service principal.
- Type: String
- Aliases: Id, PrincipalId
- Position: Named
- Default value: None
- Accept pipeline input: True
- Accept wildcard characters: False
-TenantId Tenant unique identifier.
- Type: String
- Position: 5
- Default value: None
- Accept pipeline input: False
- Accept wildcard characters: False
Assign a Savings plan Contributor role at the tenant level using Azure PowerShell script
Use the following Azure PowerShell script to assign the Savings plan Contributor role at the tenant level with PowerShell.
Import-Module Az.Accounts
Import-Module Az.Resources
Connect-AzAccount -Tenant <TenantId>
New-AzRoleAssignment -Scope "/providers/Microsoft.BillingBenefits" -PrincipalId <ObjectId> -RoleDefinitionName "Savings plan Contributor"
Parameters
-ObjectId Microsoft Entra ObjectId of the user, group, or service principal.
- Type: String
- Aliases: Id, PrincipalId
- Position: Named
- Default value: None
- Accept pipeline input: True
- Accept wildcard characters: False
-TenantId Tenant unique identifier.
- Type: String
- Position: 5
- Default value: None
- Accept pipeline input: False
- Accept wildcard characters: False
Assign a Savings plan Reader role at the tenant level using Azure PowerShell script
Use the following Azure PowerShell script to assign the Savings plan Reader role at the tenant level with PowerShell.
Import-Module Az.Accounts
Import-Module Az.Resources
Connect-AzAccount -Tenant <TenantId>
New-AzRoleAssignment -Scope "/providers/Microsoft.BillingBenefits" -PrincipalId <ObjectId> -RoleDefinitionName "Savings plan Reader"
Parameters
-ObjectId Microsoft Entra ObjectId of the user, group, or service principal.
- Type: String
- Aliases: Id, PrincipalId
- Position: Named
- Default value: None
- Accept pipeline input: True
- Accept wildcard characters: False
-TenantId Tenant unique identifier.
- Type: String
- Position: 5
- Default value: None
- Accept pipeline input: False
- Accept wildcard characters: False
Next steps
Feedback
Kommer snart: I hele 2024 udfaser vi GitHub-problemer som feedbackmekanisme for indhold og erstatter det med et nyt feedbacksystem. Du kan få flere oplysninger under: https://aka.ms/ContentUserFeedback.
Indsend og få vist feedback om