Is there a Reservations Contributor RBAC so I can create a Service Principal with tenant level read and write access for PTU reservations?

Question

Is there a Reservations Contributor RBAC so I can create a Service Principal with tenant level read and write access for PTU reservations?

Answer 1

Hello William Heng

Use the Reservations Contributor RBAC role.

• Tenant level (/providers/Microsoft.Capacity) is the scope.
• Read and write for reservations (including PTU) Assign this role at the tenant scope for SPN.
• If role assignment permissions are also needed, use Reservations Administrator.

Let me know if any further queries - feel free to reach out!

Answer 2

Yes. Azure provides a built-in Reservations Contributor RBAC role that can be used at the tenant scope and assigned to a service principal to give read/write access to reservations (including PTU reservations) across the tenant.

Key points:

1. Role capabilities
   The Reservations Contributor role:
   • Can manage (read and write) one or more reservations in the Microsoft Entra tenant.
   • Cannot delegate RBAC roles to other users.
2. Scope
   Reservation-specific RBAC roles (including Reservations Contributor) can be scoped:
   • To a specific reservation or subscription, or
   • To the tenant (directory) level, which is what is needed for tenant-wide PTU reservation management.
3. Assigning Reservations Contributor at tenant level to a service principal (PowerShell)
   Use the New-AzRoleAssignment cmdlet with the Microsoft.Capacity tenant scope and the service principal’s object ID:

      Import-Module Az.Accounts
      Import-Module Az.Resources
      
      Connect-AzAccount -Tenant <TenantId>
      
      New-AzRoleAssignment \
        -Scope "/providers/Microsoft.Capacity" \
        -PrincipalId <ObjectId> \
        -RoleDefinitionName "Reservations Contributor"
   

   • -TenantId is the tenant GUID.
   • -PrincipalId (ObjectId) is the Microsoft Entra object ID of the service principal that should manage PTU reservations.
4. Prerequisites for assigning at tenant level
   • To grant reservation roles at tenant scope, the assigning identity must have User Access Administrator rights at tenant level (typically via elevated access) and usually be a Global Administrator when assigning via the Azure portal.

Once assigned, the service principal with Reservations Contributor at scope "/providers/Microsoft.Capacity" has tenant-level read/write access to reservations, suitable for PTU reservation automation.

---

References:

• Grant RBAC access to Azure reservations by using PowerShell
• Permissions to view and manage Azure reservations
• Azure permissions for General
• Tutorial: Assign roles to service principals (preview)