Skip to content

Commit 0fadd81

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #272193 from bandersmsft/fixpr271067
MCM - Fix PR 271067
2 parents 518b587 + f2c8c01 commit 0fadd81

File tree

2 files changed

+155
-32
lines changed

2 files changed

+155
-32
lines changed

‎articles/cost-management-billing/savings-plan/permission-view-manage.md

Lines changed: 143 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -7,49 +7,35 @@ ms.reviewer: onwokolo
77
ms.service: cost-management-billing
88
ms.subservice: savings-plan
99
ms.topic: how-to
10-
ms.date: 11/17/2023
10+
ms.date: 04/15/2024
1111
ms.author: banders
1212
---
1313

1414
# Permissions to view and manage Azure savings plans
1515

1616
This article explains how savings plan permissions work and how users can view and manage Azure savings plans in the Azure portal.
17-
1817
After you buy an Azure savings plan, with sufficient permissions, you can make the following types of changes to a savings plan:
19-
2018
- Change who has access to, and manage, a savings plan
2119
- Update savings plan name
2220
- Update savings plan scope
23-
- Change auto-renewal settings
24-
25-
Except for auto-renewal, none of the changes cause a new commercial transaction or change the end date of the savings plan.
21+
- Change autorenewal settings
2622

23+
Except for autorenewal, none of the changes cause a new commercial transaction or change the end date of the savings plan.
2724
You can't make the following types of changes after purchase:
28-
2925
- Hourly commitment
3026
- Term length
3127
- Billing frequency
3228

3329
## Who can manage a savings plan by default
34-
3530
By default, the following users can view and manage savings plans:
36-
3731
- The person who buys a savings plan and the account administrator of the billing subscription used to buy the savings plan are added to the savings plan order.
3832
- Enterprise Agreement and Microsoft Customer Agreement billing administrators.
3933
- Users with elevated access to manage all Azure subscriptions and management groups.
34+
- A Savings plan administrator for savings plans in their Microsoft Entra tenant (directory)
35+
- A Savings plan reader has read-only access to savings plans in their Microsoft Entra tenant (directory)
4036

41-
The savings plan lifecycle is independent of an Azure subscription, so the savings plan isn't a resource under the Azure subscription. Instead, it's a tenant-level resource with its own Azure RBAC permission separate from subscriptions. Savings plans don't inherit permissions from subscriptions after the purchase.
42-
43-
## Grant access to individual savings plans
37+
The savings plan lifecycle is independent of an Azure subscription, so the savings plan isn't a resource under the Azure subscription. Instead, it's a tenant-level resource with its own Azure role-based access control (RBAC_ permission separate from subscriptions. Savings plans don't inherit permissions from subscriptions after the purchase.
4438

45-
Users who have owner access on the savings plan and billing administrators can delegate access management for an individual savings plan order in the Azure portal.
46-
47-
To allow other people to manage savings plans, you have two options:
48-
49-
- Delegate access management for an individual savings plan order by assigning the Owner role to a user at the resource scope of the savings plan order. If you want to give limited access, select a different role. For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md).
50-
- Add a user as billing administrator to an Enterprise Agreement or a Microsoft Customer Agreement:
51-
- For an Enterprise Agreement, add users with the Enterprise Administrator role to view and manage all savings plan orders that apply to the Enterprise Agreement. Users with the Enterprise Administrator (read only) role can only view the savings plan. Department admins and account owners can't view savings plans unless they're explicitly added to them using Access control (IAM). For more information, see [Manage Azure Enterprise roles](../manage/understand-ea-roles.md).
52-
- For a Microsoft Customer Agreement, users with the billing profile owner role or the billing profile contributor role can manage all savings plan purchases made using the billing profile. Billing profile readers and invoice managers can view all savings plans that are paid for with the billing profile. However, they can't make changes to savings plans. For more information, see [Billing profile roles and tasks](../manage/understand-mca-roles.md#billing-profile-roles-and-tasks).
5339

5440
## View and manage savings plans as a billing administrator
5541

@@ -88,6 +74,143 @@ After you have elevated access:
8874
1. Navigate to **All Services** > **Savings plans** to see all savings plans that are in the tenant.
8975
2. To make modifications to the savings plan, add yourself as an owner of the savings plan order using Access control (IAM).
9076

77+
## Grant access to individual savings plans
78+
79+
Users who have owner access on the savings plan and billing administrators can delegate access management for an individual savings plan order in the Azure portal.
80+
81+
To allow other people to manage savings plans, you have two options:
82+
83+
- Delegate access management for an individual savings plan order by assigning the Owner role to a user at the resource scope of the savings plan order. If you want to give limited access, select a different role. For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md).
84+
85+
- Add a user as billing administrator to an Enterprise Agreement or a Microsoft Customer Agreement:
86+
- For an Enterprise Agreement, add users with the Enterprise Administrator role to view and manage all savings plan orders that apply to the Enterprise Agreement. Users with the Enterprise Administrator (read only) role can only view the savings plan. Department admins and account owners can't view savings plans unless they're explicitly added to them using Access control (IAM). For more information, see [Manage Azure Enterprise roles](../manage/understand-ea-roles.md).
87+
88+
_Enterprise Administrators can take ownership of a savings plan order and they can add other users to a savings plan using Access control (IAM)._
89+
90+
- For a Microsoft Customer Agreement, users with the billing profile owner role or the billing profile contributor role can manage all savings plan purchases made using the billing profile. Billing profile readers and invoice managers can view all savings plans that are paid for with the billing profile. However, they can't make changes to savings plans. For more information, see [Billing profile roles and tasks](../manage/understand-mca-roles.md#billing-profile-roles-and-tasks).
91+
92+
93+
## Grant access with PowerShell
94+
95+
Users that have owner access for savings plan orders, users with elevated access, and [User Access Administrators](../../role-based-access-control/built-in-roles.md#user-access-administrator) can delegate access management for all savings plan orders they have access to.
96+
97+
Access granted using PowerShell isn't shown in the Azure portal. Instead, you use the `get-AzRoleAssignment` command in the following section to view assigned roles.
98+
99+
## Assign the owner role for all savings plan
100+
101+
Use the following Azure PowerShell script to give a user Azure RBAC access to all savings plan orders in their Microsoft Entra tenant (directory).
102+
103+
```azurepowershell
104+
105+
Import-Module Az.Accounts
106+
Import-Module Az.Resources
107+
108+
Connect-AzAccount -Tenant <TenantId>
109+
$response = Invoke-AzRestMethod -Path /providers/Microsoft.BillingBenefits/savingsPlans?api-version=2022-11-01 -Method GET
110+
$responseJSON = $response.Content | ConvertFrom-JSON
111+
$savingsPlanObjects = $responseJSON.value
112+
113+
foreach ($savingsPlan in $savingsPlanObjects)
114+
{
115+
$savingsPlanOrderId = $savingsPlan.id.substring(0, 84)
116+
Write-Host "Assigning Owner role assignment to "$savingsPlanOrderId
117+
New-AzRoleAssignment -Scope $savingsPlanOrderId -ObjectId <ObjectId> -RoleDefinitionName Owner
118+
}
119+
120+
```
121+
122+
When you use the PowerShell script to assign the ownership role and it runs successfully, a success message isn’t returned.
123+
124+
### Parameters
125+
126+
**-ObjectId** Microsoft Entra ObjectId of the user, group, or service principal.
127+
- Type: String
128+
- Aliases: Id, PrincipalId
129+
- Position: Named
130+
- Default value: None
131+
- Accept pipeline input: True
132+
- Accept wildcard characters: False
133+
134+
**-TenantId** Tenant unique identifier.
135+
- Type: String
136+
- Position: 5
137+
- Default value: None
138+
- Accept pipeline input: False
139+
- Accept wildcard characters: False
140+
141+
## Tenant-level access
142+
143+
[User Access Administrator](../../role-based-access-control/built-in-roles.md#user-access-administrator) rights are required before you can grant users or groups the Savings plan Administrator and Savings plan Reader roles at the tenant level. In order to get User Access Administrator rights at the tenant level, follow [Elevate access](../../role-based-access-control/elevate-access-global-admin.md) steps.
144+
145+
### Add a Savings plan Administrator role or Savings plan Reader role at the tenant level
146+
You can assign these roles from the [Azure portal](https://portal.azure.com).
147+
148+
1. Sign in to the Azure portal and navigate to **Savings plan**.
149+
1. Select a savings plan that you have access to.
150+
1. At the top of the page, select **Role Assignment**.
151+
1. Select the **Roles** tab.
152+
1. To make modifications, add a user as a Savings plan Administrator or Savings plan Reader using Access control.
153+
154+
### Add a Savings plan Administrator role at the tenant level using Azure PowerShell script
155+
156+
Use the following Azure PowerShell script to add a Savings plan Administrator role at the tenant level with PowerShell.
157+
158+
```azurepowershell
159+
Import-Module Az.Accounts
160+
Import-Module Az.Resources
161+
Connect-AzAccount -Tenant <TenantId>
162+
New-AzRoleAssignment -Scope "/providers/Microsoft.BillingBenefits" -PrincipalId <ObjectId> -RoleDefinitionName "Savings plan Administrator"
163+
```
164+
165+
#### Parameters
166+
167+
**-ObjectId** Microsoft Entra ObjectId of the user, group, or service principal.
168+
- Type: String
169+
- Aliases: Id, PrincipalId
170+
- Position: Named
171+
- Default value: None
172+
- Accept pipeline input: True
173+
- Accept wildcard characters: False
174+
175+
**-TenantId** Tenant unique identifier.
176+
- Type: String
177+
- Position: 5
178+
- Default value: None
179+
- Accept pipeline input: False
180+
- Accept wildcard characters: False
181+
182+
### Assign a Savings plan Reader role at the tenant level using Azure PowerShell script
183+
184+
Use the following Azure PowerShell script to assign the Savings plan Reader role at the tenant level with PowerShell.
185+
186+
```azurepowershell
187+
188+
Import-Module Az.Accounts
189+
Import-Module Az.Resources
190+
191+
Connect-AzAccount -Tenant <TenantId>
192+
193+
New-AzRoleAssignment -Scope "/providers/Microsoft.BillingBenefits" -PrincipalId <ObjectId> -RoleDefinitionName "Savings plan Reader"
194+
```
195+
196+
#### Parameters
197+
198+
**-ObjectId** Microsoft Entra ObjectId of the user, group, or service principal.
199+
- Type: String
200+
- Aliases: Id, PrincipalId
201+
- Position: Named
202+
- Default value: None
203+
- Accept pipeline input: True
204+
- Accept wildcard characters: False
205+
206+
**-TenantId** Tenant unique identifier.
207+
- Type: String
208+
- Position: 5
209+
- Default value: None
210+
- Accept pipeline input: False
211+
- Accept wildcard characters: False
212+
213+
91214
## Next steps
92215

93216
- [Manage Azure savings plans](manage-savings-plan.md).

0 commit comments

Comments
 (0)