Understand Microsoft Customer Agreement administrative roles in Azure
To manage your billing account for a Microsoft Customer Agreement, use the roles described in the following sections. These roles are in addition to the built-in roles Azure has to control access to resources. For more information, see Azure built-in roles.
This article applies to a billing account for a Microsoft Customer Agreement. Check if you have access to a Microsoft Customer Agreement.
Watch the Manage access to your MCA billing account video to learn how you can control access to your Microsoft Customer Agreement (MCA) billing account.
The following table describes the billing roles you use to manage your billing account, billing profiles, and invoice sections.
Role | Description |
---|---|
Billing account owner | Manage everything for billing account |
Billing account contributor | Manage everything except permissions on the billing account |
Billing account reader | Read-only view of everything on billing account |
Billing profile owner | Manage everything for billing profile |
Billing profile contributor | Manage everything except permissions on the billing profile |
Billing profile reader | Read-only view of everything on billing profile |
Invoice manager | View and pay invoices for billing profile |
Invoice section owner | Manage everything on invoice section |
Invoice section contributor | Manage everything except permissions on the invoice section |
Invoice section reader | Read-only view of everything on the invoice section |
Azure subscription creator | Create Azure subscriptions |
A billing account is created when you sign up to use Azure. You use your billing account to manage invoices, payments, and track costs. Roles on the billing account have the highest level of permissions and users in these roles get visibility into the cost and billing information for your entire account. Assign these roles only to users that need to view invoices, and track costs for your entire account like member of the finance and the accounting teams. For more information, see Understand billing account.
The following tables show what role you need to complete tasks in the context of the billing account.
Note
The Global Administrator role is above the Billing Account Administrator. Global Administrators in a Microsoft Entra ID tenant can add or remove themselves as Billing Account Administrators at any time to the Microsoft Customer Agreement. For more information about elevating access, see Elevate access to manage billing accounts.
Task | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|
View role assignments for billing account | ✔ | ✔ | ✔ |
Give others permissions to view and manage the billing account | ✔ | ✘ | ✘ |
View billing account properties like address, agreements and more | ✔ | ✔ | ✔ |
Update billing account properties like sold-to, display name, and more | ✔ | ✔ | ✘ |
Task | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|
View all billing profiles for the account | ✔ | ✔ | ✔ |
Create new billing profiles | ✔ | ✔ | ✘ |
Task | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|
View all invoices for the account | ✔ | ✔ | ✔ |
Pay invoices with credit card | ✔ | ✔ | ✘ |
Download invoices, Azure usage files, price sheets, and tax documents | ✔ | ✔ | ✔ |
Task | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|
View all products purchased for the account | ✔ | ✔ | ✔ |
Manage billing for products like cancel, turn off auto renewal, and more | ✔ | ✔ | ✘ |
Task | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|
View all Azure subscriptions created for the billing account | ✔ | ✔ | ✔ |
Create new Azure subscriptions | ✔ | ✔ | ✘ |
Cancel Azure subscriptions | ✘ | ✘ | ✘ |
Each billing account has at least one billing profile. Your first billing profile is set up when you sign up to use Azure. A monthly invoice is generated for the billing profile and contains all its associated charges from the prior month. You can set up more billing profiles based on your needs. Users with roles on a billing profile can view cost, set budget, and manage and pay its invoices. Assign these roles to users who are responsible for managing budget and paying invoices for the billing profile like members of the business administration teams in your organization.
For more information, see Understand billing profiles.
For more information about assigning access for users, see Access of enterprise administrators, department administrators, and account owners on invoice sections.
The following tables show what role you need to complete tasks in the context of the billing profile.
Task | Billing profile owner | Billing profile contributor | Billing profile reader | Invoice manager | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|---|---|---|---|
View role assignments for the billing profile | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Give others permissions to view and manage the billing profile | ✔ | ✘ | ✘ | ✘ | ✔ | ✘ | ✘ |
View billing profile properties like PO number, bill-to, and more | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Update billing profile properties | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
View policies applied on the billing profile like Azure reservation purchases, Azure Marketplace purchases, and more | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Apply policies on the billing profile | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Task | Billing profile owner | Billing profile contributor | Billing profile reader | Invoice manager | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|---|---|---|---|
View all the invoices for the billing profile | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Pay invoices with credit card | ✔ | ✔ | ✘ | ✔ | ✔ | ✘ | ✘ |
Download invoices, Azure usage and charges files, price sheets and tax documents for the billing profile | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Task | Billing profile owner | Billing profile contributor | Billing profile reader | Invoice manager | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|---|---|---|---|
View all the invoice sections for the billing profile | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Create new invoice section for the billing profile | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Task | Billing profile owner | Billing profile contributor | Billing profile reader | Invoice manager | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|---|---|---|---|
View all products purchased for the billing profile | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Manage billing for products like cancel, turn off auto renewal, and more | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Change billing profile for the products | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Task | Billing profile owner | Billing profile contributor | Billing profile reader | Invoice manager | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|---|---|---|---|
View payment methods for the billing profile | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Manage payment methods such as replacing credit card, detaching credit card, and more | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Track Azure credits balance for the billing profile | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Task | Billing profile owner | Billing profile contributor | Billing profile reader | Invoice manager | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|---|---|---|---|
View all Azure subscriptions for the billing profile | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Create new Azure subscriptions | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Cancel Azure subscriptions | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ |
Change billing profile for the Azure subscriptions | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Each billing profile contains one invoice section by default. You may create more invoice sections to group cost on the billing profile's invoice. Users with roles on an invoice section can control who creates Azure subscriptions and make other purchases. Assign these roles to users who set up Azure environment for teams in our organization like engineering leads and technical architects. For more information, see Understand invoice section.
The following tables show what role you need to complete tasks in the context of invoice sections.
Tasks | Invoice section owner | Invoice section contributor | Invoice section reader | Azure subscription creator | Billing profile owner | Billing profile contributor | Billing profile reader | Invoice manager | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|---|---|---|---|---|---|---|---|
View role assignments for invoice section | ✔ | ✔ | ✔ | ✘ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Give others permissions to view and manage the invoice section | ✔ | ✘ | ✘ | ✘ | ✔ | ✘ | ✘ | ✘ | ✔ | ✘ | ✘ |
View invoice section properties | ✔ | ✔ | ✔ | ✘ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Update invoice section properties | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Tasks | Invoice section owner | Invoice section contributor | Invoice section reader | Azure subscription creator | Billing profile owner | Billing profile contributor | Billing profile reader | Invoice manager | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|---|---|---|---|---|---|---|---|
View all products bought for the invoice section | ✔ | ✔ | ✔ | ✘ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Manage billing for products like cancel, turn off auto renewal, and more | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Change invoice section for the products | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Tasks | Invoice section owner | Invoice section contributor | Invoice section reader | Azure subscription creator | Billing profile owner | Billing profile contributor | Billing profile reader | Invoice manager | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|---|---|---|---|---|---|---|---|
View all Azure subscriptions for invoice section | ✔ | ✔ | ✔ | ✘ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
Create Azure subscriptions | ✔ | ✔ | ✘ | ✔ | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Cancel Azure subscriptions | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ |
Change invoice section for the Azure subscription | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Request billing ownership of subscriptions from users in other billing accounts | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
The following table shows what role you need to complete tasks in the context of a subscription.
Tasks | Invoice section owner | Invoice section contributor | Invoice section reader | Azure subscription creator | Billing profile owner | Billing profile contributor | Billing profile reader | Invoice manager | Billing account owner | Billing account contributor | Billing account reader |
---|---|---|---|---|---|---|---|---|---|---|---|
Create subscriptions | ✔ | ✔ | ✘ | ✔ | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Update cost center for the subscription | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Change invoice section for the subscription | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Change billing profile for the subscription | ✘ | ✘ | ✘ | ✘ | ✔ | ✔ | ✘ | ✘ | ✔ | ✔ | ✘ |
Cancel Azure subscriptions | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ | ✘ |
Sign in to the Azure portal.
Search for Cost Management + Billing.
Select Access control (IAM) at a scope such as billing account, billing profile, or invoice section, where you want to give access.
The Access control (IAM) page lists users and groups that are assigned to each role for that scope.
To give access to a user, Select Add from the top of the page. In the Role drop-down list, select a role. Enter the email address of the user to whom you want to give access. Select Save to assign the role.
To remove access for a user, select the user with the role assignment you want to remove. Select Remove.
Check the agreement type to determine whether you have access to a billing account for a Microsoft Customer Agreement.
Go to the Azure portal to check for billing account access. Search for and select Cost Management + Billing.
If you have access to just one billing scope, select Properties from the menu. You have access to a billing account for a Microsoft Customer Agreement if the billing account type is Microsoft Customer Agreement.
If you have access to multiple billing scopes, check the type in the billing account column. You have access to a billing account for a Microsoft Customer Agreement if the billing account type for any of the scopes is Microsoft Customer Agreement.
If you need help, contact support to get your issue resolved quickly.
See the following articles to learn about your billing account:
Feedback
https://aka.ms/ContentUserFeedback.
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see:Submit and view feedback for