Assign admin roles and decision rights
Spending policies, limits, alerts, and credit requests all need an owner. Microsoft 365 doesn't require every admin to hold the highest-privilege role to do their part. A narrower, purpose-built role handles routine changes like raising a limit or approving a request, so admins don't need the organization's most powerful admin account for day-to-day budget work. Different Microsoft Entra ID admin roles cover different parts of cost management, so assign each task to the least-privileged role that can complete it.
Who can do what
| Admin role | Permissions |
|---|---|
| Global Administrator | Tenant-wide administration, including billing. Can create spending policies and set billing methods. Microsoft recommends limiting its use to situations where no narrower role will do, because it also carries broad access to the rest of the tenant. |
| Billing Administrator | Can create spending policies and add, select, or change billing methods on a policy. |
| AI Administrator | Can edit existing spending policies, manage limits and alerts, and manage billing methods, but can't create a new spending policy. |
| License Administrator | Can edit existing spending policies and manage limits, alerts, and billing methods, similar to AI Administrator. |
| AI Reader, Global Reader, and other reader roles | Read-only: can view consumption dashboards and credit requests, but can't create or change a spending policy, limit, alert, or billing method. |
Credit requests follow the same pattern: Global Administrator, Billing Administrator, and AI Administrator can all approve or reject them; reader roles can only view them.
In practice, creating your organization's first policy requires a Global Administrator or Billing Administrator. AI Administrators and License Administrators can make day-to-day policy adjustments, such as raising a limit. Credit-request approvals require a Global Administrator, Billing Administrator, or AI Administrator; the License Administrator role alone doesn't grant approval rights.
Matching roles to the people doing the work
If your organization already has Power Platform or Copilot Studio admins, map their existing responsibilities onto these roles instead of inventing new ones:
| Existing responsibility | Recommended admin role |
|---|---|
| Tenant-wide administration | Global Administrator (no change needed) |
| Power Platform or Dynamics 365 administration | AI Administrator, so they can manage spending policies |
| A specific environment | AI Reader, so they can view consumption when they need to, without configuration rights |
Caldova decision
Caldova's Global Administrator creates the pilot department's spending policy once, then delegates day-to-day management to the IT admin. Caldova assigns that admin the AI Administrator role, so they can adjust limits, respond to alerts, and approve credit requests without needing standing Global Administrator access. The finance manager receives a reader role, so they can check consumption anytime without permission to modify settings.