Skip to content

Commit bcdfe01

Browse files
nwokolonwokolo
authored
Added references to SP Administrator and Reader roles
1 parent 5f65b58 commit bcdfe01

File tree

1 file changed

+141
-16
lines changed

1 file changed

+141
-16
lines changed

‎articles/cost-management-billing/savings-plan/permission-view-manage.md

Lines changed: 141 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -14,42 +14,28 @@ ms.author: banders
1414
# Permissions to view and manage Azure savings plans
1515

1616
This article explains how savings plan permissions work and how users can view and manage Azure savings plans in the Azure portal.
17-
1817
After you buy an Azure savings plan, with sufficient permissions, you can make the following types of changes to a savings plan:
19-
2018
- Change who has access to, and manage, a savings plan
2119
- Update savings plan name
2220
- Update savings plan scope
2321
- Change auto-renewal settings
2422

2523
Except for auto-renewal, none of the changes cause a new commercial transaction or change the end date of the savings plan.
26-
2724
You can't make the following types of changes after purchase:
28-
2925
- Hourly commitment
3026
- Term length
3127
- Billing frequency
3228

3329
## Who can manage a savings plan by default
34-
3530
By default, the following users can view and manage savings plans:
36-
3731
- The person who buys a savings plan and the account administrator of the billing subscription used to buy the savings plan are added to the savings plan order.
3832
- Enterprise Agreement and Microsoft Customer Agreement billing administrators.
3933
- Users with elevated access to manage all Azure subscriptions and management groups.
34+
- A Savings plan administrator for savings plans in their Microsoft Entra tenant (directory)
35+
- A Savings plan reader has read-only access to savings plans in their Microsoft Entra tenant (directory)
4036

4137
The savings plan lifecycle is independent of an Azure subscription, so the savings plan isn't a resource under the Azure subscription. Instead, it's a tenant-level resource with its own Azure RBAC permission separate from subscriptions. Savings plans don't inherit permissions from subscriptions after the purchase.
4238

43-
## Grant access to individual savings plans
44-
45-
Users who have owner access on the savings plan and billing administrators can delegate access management for an individual savings plan order in the Azure portal.
46-
47-
To allow other people to manage savings plans, you have two options:
48-
49-
- Delegate access management for an individual savings plan order by assigning the Owner role to a user at the resource scope of the savings plan order. If you want to give limited access, select a different role. For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md).
50-
- Add a user as billing administrator to an Enterprise Agreement or a Microsoft Customer Agreement:
51-
- For an Enterprise Agreement, add users with the Enterprise Administrator role to view and manage all savings plan orders that apply to the Enterprise Agreement. Users with the Enterprise Administrator (read only) role can only view the savings plan. Department admins and account owners can't view savings plans unless they're explicitly added to them using Access control (IAM). For more information, see [Manage Azure Enterprise roles](../manage/understand-ea-roles.md).
52-
- For a Microsoft Customer Agreement, users with the billing profile owner role or the billing profile contributor role can manage all savings plan purchases made using the billing profile. Billing profile readers and invoice managers can view all savings plans that are paid for with the billing profile. However, they can't make changes to savings plans. For more information, see [Billing profile roles and tasks](../manage/understand-mca-roles.md#billing-profile-roles-and-tasks).
5339

5440
## View and manage savings plans as a billing administrator
5541

@@ -88,6 +74,145 @@ After you have elevated access:
8874
1. Navigate to **All Services** > **Savings plans** to see all savings plans that are in the tenant.
8975
2. To make modifications to the savings plan, add yourself as an owner of the savings plan order using Access control (IAM).
9076

77+
## Grant access to individual savings plans
78+
79+
Users who have owner access on the savings plan and billing administrators can delegate access management for an individual savings plan order in the Azure portal.
80+
81+
To allow other people to manage savings plans, you have two options:
82+
83+
- Delegate access management for an individual savings plan order by assigning the Owner role to a user at the resource scope of the savings plan order. If you want to give limited access, select a different role. For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md).
84+
85+
- Add a user as billing administrator to an Enterprise Agreement or a Microsoft Customer Agreement:
86+
- For an Enterprise Agreement, add users with the Enterprise Administrator role to view and manage all savings plan orders that apply to the Enterprise Agreement. Users with the Enterprise Administrator (read only) role can only view the savings plan. Department admins and account owners can't view savings plans unless they're explicitly added to them using Access control (IAM). For more information, see [Manage Azure Enterprise roles](../manage/understand-ea-roles.md).
87+
88+
_Enterprise Administrators can take ownership of a savings plan order and they can add other users to a savings plan using Access control (IAM)._
89+
90+
- For a Microsoft Customer Agreement, users with the billing profile owner role or the billing profile contributor role can manage all savings plan purchases made using the billing profile. Billing profile readers and invoice managers can view all savings plans that are paid for with the billing profile. However, they can't make changes to savings plans. For more information, see [Billing profile roles and tasks](../manage/understand-mca-roles.md#billing-profile-roles-and-tasks).
91+
92+
93+
## Grant access with PowerShell
94+
95+
Users that have owner access for savings plan orders, users with elevated access, and [User Access Administrators](../../role-based-access-control/built-in-roles.md#user-access-administrator) can delegate access management for all savings plan orders they have access to.
96+
97+
Access granted using PowerShell isn't shown in the Azure portal. Instead, you use the `get-AzRoleAssignment` command in the following section to view assigned roles.
98+
99+
## Assign the owner role for all savings plan
100+
101+
Use the following Azure PowerShell script to give a user Azure RBAC access to all savings plan orders in their Microsoft Entra tenant (directory).
102+
103+
```azurepowershell
104+
105+
Import-Module Az.Accounts
106+
Import-Module Az.Resources
107+
108+
Connect-AzAccount -Tenant <TenantId>
109+
110+
$response = Invoke-AzRestMethod -Path /providers/Microsoft.Capacity/reservations?api-version=2020-06-01 -Method GET
111+
112+
$responseJSON = $response.Content | ConvertFrom-JSON
113+
114+
$reservationObjects = $responseJSON.value
115+
116+
foreach ($reservation in $reservationObjects)
117+
{
118+
$reservationOrderId = $reservation.id.substring(0, 84)
119+
Write-Host "Assigning Owner role assignment to "$reservationOrderId
120+
New-AzRoleAssignment -Scope $reservationOrderId -ObjectId <ObjectId> -RoleDefinitionName Owner
121+
}
122+
```
123+
124+
When you use the PowerShell script to assign the ownership role and it runs successfully, a success message isn’t returned.
125+
126+
### Parameters
127+
128+
**-ObjectId** Microsoft Entra ObjectId of the user, group, or service principal.
129+
- Type: String
130+
- Aliases: Id, PrincipalId
131+
- Position: Named
132+
- Default value: None
133+
- Accept pipeline input: True
134+
- Accept wildcard characters: False
135+
136+
**-TenantId** Tenant unique identifier.
137+
- Type: String
138+
- Position: 5
139+
- Default value: None
140+
- Accept pipeline input: False
141+
- Accept wildcard characters: False
142+
143+
## Tenant-level access
144+
145+
[User Access Administrator](../../role-based-access-control/built-in-roles.md#user-access-administrator) rights are required before you can grant users or groups the Savings plan Administrator and Savings plan Reader roles at the tenant level. In order to get User Access Administrator rights at the tenant level, follow [Elevate access](../../role-based-access-control/elevate-access-global-admin.md) steps.
146+
147+
### Add a Savings plan Administrator role or Savings plan Reader role at the tenant level
148+
You can assign these roles from the [Azure portal](https://portal.azure.com).
149+
150+
1. Sign in to the Azure portal and navigate to **Savings plan**.
151+
1. Select a savings plan that you have access to.
152+
1. At the top of the page, select **Role Assignment**.
153+
1. Select the **Roles** tab.
154+
1. To make modifications, add a user as a Savings plan Administrator or Savings plan Reader using Access control.
155+
156+
### Add a Savings plan Administrator role at the tenant level using Azure PowerShell script
157+
158+
Use the following Azure PowerShell script to add a Savings plan Administrator role at the tenant level with PowerShell.
159+
160+
```azurepowershell
161+
Import-Module Az.Accounts
162+
Import-Module Az.Resources
163+
Connect-AzAccount -Tenant <TenantId>
164+
New-AzRoleAssignment -Scope "/providers/Microsoft.Capacity" -PrincipalId <ObjectId> -RoleDefinitionName "Savings plan Administrator"
165+
```
166+
167+
#### Parameters
168+
169+
**-ObjectId** Microsoft Entra ObjectId of the user, group, or service principal.
170+
- Type: String
171+
- Aliases: Id, PrincipalId
172+
- Position: Named
173+
- Default value: None
174+
- Accept pipeline input: True
175+
- Accept wildcard characters: False
176+
177+
**-TenantId** Tenant unique identifier.
178+
- Type: String
179+
- Position: 5
180+
- Default value: None
181+
- Accept pipeline input: False
182+
- Accept wildcard characters: False
183+
184+
### Assign a Savings plan Reader role at the tenant level using Azure PowerShell script
185+
186+
Use the following Azure PowerShell script to assign the Savings plan Reader role at the tenant level with PowerShell.
187+
188+
```azurepowershell
189+
190+
Import-Module Az.Accounts
191+
Import-Module Az.Resources
192+
193+
Connect-AzAccount -Tenant <TenantId>
194+
195+
New-AzRoleAssignment -Scope "/providers/Microsoft.Capacity" -PrincipalId <ObjectId> -RoleDefinitionName "Savings plan Reader"
196+
```
197+
198+
#### Parameters
199+
200+
**-ObjectId** Microsoft Entra ObjectId of the user, group, or service principal.
201+
- Type: String
202+
- Aliases: Id, PrincipalId
203+
- Position: Named
204+
- Default value: None
205+
- Accept pipeline input: True
206+
- Accept wildcard characters: False
207+
208+
**-TenantId** Tenant unique identifier.
209+
- Type: String
210+
- Position: 5
211+
- Default value: None
212+
- Accept pipeline input: False
213+
- Accept wildcard characters: False
214+
215+
91216
## Next steps
92217

93218
- [Manage Azure savings plans](manage-savings-plan.md).

0 commit comments

Comments
 (0)