How to add Invoice Manager role IAM

Question

I would like to grant access for viewing and paying invoices to our accounts team.

They are not technical and should only have rights related to this specific duty on the subscription.

I see from the document here that there is an Invoice Manager role designed for this https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/understand-mca-roles

However in IAM I don't see any such role. The closest seems to be Billing Reader (which can't pay invoices)

Has it been replaced with another role? Do I need to create this role myself (in which case what permissions set should I use?)

What's the best way to grant access to the subscription to be able to pay an invoice, without access to create or change anything else?

Answer 1

Hi Andy,

Please navigate to the Cost Management + Billing -- Billing profiles blade using link below:

https://portal.azure.com/#view/Microsoft_Azure_GTM/ModernBillingMenuBlade/~/BillingProfiles

On right, click on the billing profile you would like to add role assignment to. Next click Access control (IAM) blade, and then click Add. Select Invoice manager and then search for and Add user account.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Answer 2

Hello Andy Clapham,

Thanks for your question.

Billing Reader cant do this. The roles who can pay invoices are specified here: Billing account owner, Billing profile owner, Billing profile Contributor and Invoice Manager

https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/understand-mca-roles#manage-invoices-for-billing-profile

Access to billing can be done here:

https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/manage-billing-access

You can also create a custom role if you still cannot find the invoice mannager role.

Example:

{
  "Name": "Custom Invoice Manager",
  "Description": "Custom role for managing and paying invoices.",
  "Actions": [
    "Microsoft.Billing/*/read",
    "Microsoft.Billing/*/write"
  ],
  "NotActions": [],
  "AssignableScopes": [
    "/subscriptions/{subscription-id}"
  ]
}

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola