Assign access to Carbon optimization in Azure

Carbon optimization uses role-based access control (RBAC) to manage access to emissions data, recommendations, and resource configurations. The access a user needs depends on what they need to do and which view they need to use:

  • Use subscription-level access to view emissions for selected subscriptions, view recommendations, and analyze resource group or resource-level emissions.
  • Use billing account-level or enrollment-level access to view emissions across all subscriptions under an eligible billing account.
  • Use Owner or Contributor permissions to modify resource configurations.

Permissions overview

View Emissions - Grants access to carbon emissions data. Access can be assigned at the subscription level or, for eligible billing accounts, at the billing account or enrollment level.

View Recommendations - Provides access to efficiency and sustainability recommendations. Permissions must be granted separately and can be assigned at the subscription, resource group, or resource level.

Edit Resource Configuration - Allows modifications to resource settings related to carbon optimization. Requires Owner/Contributor permission.

Emissions data access

Users can view emissions data when they have the required role for the scope they want to analyze.

Subscription-level emissions access

By default, users with the following roles can view emissions data without requiring other role assignments:

  • Subscription Owners
  • Subscription Contributors
  • Subscription Readers

Users without these roles can gain access by being assigned the Carbon Optimization Reader role at the subscription level.

Use subscription-level access to view emissions for selected subscriptions, analyze emissions by subscription, resource group, resource, resource type, or location, and view resource group or resource-level details.

Billing account-level emissions access

Users can view emissions across all subscriptions under an eligible billing account when they have the required role at the billing account or enrollment scope. This view supports centralized sustainability reporting at subscription-level granularity.

Account type Required access
Microsoft Customer Agreement Billing Account Owner, Billing Account Contributor, Billing Account Reader, or Carbon Optimization Reader at the billing account level
Enterprise Agreement Enrollment Owner, Enrollment Contributor, or Enrollment Reader

The Carbon Optimization Reader role at the billing account level is available for Microsoft Customer Agreement accounts. Support for Enterprise Agreement accounts will be documented when available.

Carbon Optimization Reader role

The Carbon Optimization Reader role is designed for users who only need to view emissions data without access to recommendations, other service metrics, or the ability to change resource configurations. This role is ideal for IT sustainability teams or professionals who require visibility into carbon emissions data.

The role isn't intended for people that need to access recommendations or modify resource settings.

Assign the Carbon Optimization Reader role at the subscription level

To assign the Carbon Optimization Reader role to a user, follow these steps:

  1. Sign In: Go to the Azure portal and sign in with an account that has Owner or Contributor permission at the subscription level.
  2. Select Subscription: Choose the subscription for which you want to grant emissions data access.
  3. Open IAM Panel: From the left menu, select Access Control (IAM).
  4. Add Role Assignment: Select + Add and then select Add role assignment. A new pane opens where you assign a role.
  5. Select Role: In the Role list, search for Carbon Optimization Reader and select it.
  6. Assign to User: In the Assign access to list, select User, group, or service principal. Select the Select members option, search for the user or group to assign to the role, and then select the Select option.
  7. Review and Assign: Review your selections and select Review + Assign to complete the process.

The user now has access to view subscription emissions data. They might not be able to access recommendations or modify resource configurations, depending on their other roles.

Assign access at the billing account level

To view billing account-level emissions, assign the required role at the billing account or enrollment scope:

  • For Microsoft Customer Agreement accounts: Billing Account Owner, Billing Account Contributor, Billing Account Reader, or Carbon Optimization Reader.
  • For Enterprise Agreement accounts: Enrollment Owner, Enrollment Contributor, or Enrollment Reader.

After access is assigned, users can open Carbon optimization in the Azure portal, select the Billing Accounts view, and choose the billing account they want to analyze.

Service principal access

Service principals are supported for automated emissions data collection through the Carbon Optimization API.

  1. Create or identify the service principal used by your reporting pipeline.
  2. Assign the required role at the subscription scope for subscription-level API requests or at the billing account scope for billing account-level API requests.
  3. Use the service principal to acquire an Azure Resource Manager token.
  4. Call the Carbon Optimization API using the token.

For billing account-level API requests, the service principal must have the required billing account-level role.

Roles and permissions

The following table outlines the access permissions associated with each role:

Role View subscription-level emissions View billing account-level emissions View recommendations Edit resource configuration
Subscription Owner Yes No Yes Yes
Subscription Contributor Yes No Yes Yes
Subscription Reader Yes No Yes No
Resource Group Owner No No Yes Yes
Resource Group Contributor No No Yes Yes
Resource Group Reader No No Yes No
Resource Owner No No Yes Yes
Resource Contributor No No Yes Yes
Resource Reader No No Yes No
Carbon Optimization Reader at subscription scope Yes No No No
Billing Account Owner No Yes No No
Billing Account Contributor No Yes No No
Billing Account Reader No Yes No No
Carbon Optimization Reader at billing account scope No Yes, for Microsoft Customer Agreement accounts No No
Enrollment Owner No Yes, for Enterprise Agreement enrollments No No
Enrollment Contributor No Yes, for Enterprise Agreement enrollments No No
Enrollment Reader No Yes, for Enterprise Agreement enrollments No No

Recommendation access and resource configuration access remain subscription, resource group, or resource scoped. Billing account-level access is used to view billing account-level emissions data.

Next steps

  • อัปเดตล่าสุดเมื่อ