create subscriptions

Question

Hi All

i have an Azure Tenant, i want to provide access to one of my user to create subscriptions. What level of access is required. Do the access needs to be provided at the management group level. Experts guide me.

Answer 1

@Glenn Maxwell

Thank you for posting this in Microsoft Q&A.

You need the following permissions to create subscriptions for a Microsoft Customer Agreement (MCA):

• Owner or contributor role on the invoice section, billing profile or billing account. Or Azure subscription creator role on the invoice section.

For more information, see Subscription billing roles and task.

You can also refer to below article,

https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription#permission-required-to-create-azure-subscriptions

The following table shows what role you need to complete tasks in the context of a subscription.

The following table describes the billing roles you use to manage your billing account, billing profiles, and invoice sections.

Role	Description
Billing account owner	Manage everything for billing account
Billing account owner	Manage everything for billing account
Billing account contributor	Manage everything except permissions on the billing account
Billing account reader	Read-only view of everything on billing account
Billing profile owner	Manage everything for billing profile
Billing profile contributor	Manage everything except permissions on the billing profile
Billing profile reader	Read-only view of everything on billing profile
Invoice manager	View and pay invoices for billing profile
Invoice section owner	Manage everything on invoice section
Invoice section contributor	Manage everything except permissions on the invoice section
Invoice section reader	Read-only view of everything on the invoice section
Azure subscription creator	Create Azure subscriptions

For more information you can also refer to below article,

https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/understand-mca-roles#billing-role-definitions

If you are using classic administrator in your Azure tenant, then you can see below role with specific tasks they can perform,

Refer below article,

https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles#classic-subscription-administrator-roles

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.