403 Authorization Failed while calling Reservation Order List API

Question

Hi,

I'm encountering an issue with the "Microsoft.Capacity/reservationOrders/read" permission. I have this permission assigned at the Root Management Group level. However, when I attempt to fetch reservation order data using the Azure API, I receive the following error:

Message: The client '

Answer 1

Hello Prakash

Thank you for the feedback. The key limitation here is the scope context.

Even though the assigned permissions are valid for managing reservation resources, Azure Reservations are billing-scoped, not management group-scoped. This means:

Assigning permissions at the Root Management Group level won’t grant access to reservation orders.

You must ensure that the role (Billing Reader or a custom role with the proper permissions) is explicitly assigned at the billing account or billing profile level in the Azure portal.

1.      Go to the Azure portal → Search for “Cost Management + Billing”

2.      In the Billing scopes, select the Billing account.

3.      Under Access control (IAM), ensure you have:

• Billing Reader, or
• A custom role with all required Microsoft.Capacity/* permissions
• Assigned at the billing account level.

Please go through https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/manage-reserved-vm-instance

Do remember to mark as “Accepted Answer” and consider giving it an upvote. This helps others in the community as well.

Answer 2

Hi Prakash

Thanks for using QandA platform.

Even though you've assigned the Microsoft.Capacity/reservationOrders/read permission at the Root Management Group, Azure does not treat reservation orders as traditional ARM resources with hierarchy-based scoping. Instead, reservation orders are account-scoped objects tied to billing, and they are managed outside of the typical ARM RBAC scope model.

You have the correct permission assigned however, it's being applied in a scope that doesn't apply to reservation orders.

To read reservation orders via the API, you must be assigned a Billing Reader or Reservation Reader role at the Billing Account scope.

Find: https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/manage-reserved-vm-instance

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Obinna