Understand Microsoft Customer Agreement administrative roles in Azure

To manage your billing account for a Microsoft Customer Agreement, use the roles described in the following sections. These roles are in addition to the built-in roles Azure has to control access to resources. For more information, see Azure built-in roles.

This article applies to a billing account for a Microsoft Customer Agreement. Check if you have access to a Microsoft Customer Agreement.

Watch the Manage access to your MCA billing account video to learn how you can control access to your Microsoft Customer Agreement (MCA) billing account.

Billing role definitions

The following table describes the billing roles you use to manage your billing account, billing profiles, and invoice sections.

Billing account roles and tasks

A billing account is created when you sign up to use Azure. You use your billing account to manage invoices, payments, and track costs. Roles on the billing account have the highest level of permissions and users in these roles get visibility into the cost and billing information for your entire account. Assign these roles only to users that need to view invoices, and track costs for your entire account like member of the finance and the accounting teams. For more information, see Understand billing account.

The following tables show what role you need to complete tasks in the context of the billing account.

Manage billing account permissions and properties

Manage billing profiles for billing account

Manage invoices for billing account

Manage products for billing account

Manage subscriptions for billing account

Billing profile roles and tasks

Each billing account has at least one billing profile. Your first billing profile is set up when you sign up to use Azure. A monthly invoice is generated for the billing profile and contains all its associated charges from the prior month. You can set up more billing profiles based on your needs. Users with roles on a billing profile can view cost, set budget, and manage and pay its invoices. Assign these roles to users who are responsible for managing budget and paying invoices for the billing profile like members of the business administration teams in your organization.

For more information, see Understand billing profiles.

For more information about assigning access for users, see Access of enterprise administrators, department administrators, and account owners on invoice sections.

The following tables show what role you need to complete tasks in the context of the billing profile.

Manage billing profile permissions, properties, and policies

Manage invoices for billing profile

Manage invoice sections for billing profile

Manage products for billing profile

Manage payment methods for billing profile

Manage subscriptions for billing profile

Invoice section roles and tasks

Each billing profile contains one invoice section by default. You can create more invoice sections to group cost on the billing profile's invoice. Users with roles on an invoice section can control who creates Azure subscriptions and make other purchases. Assign these roles to users who set up Azure environment for teams in our organization like engineering leads and technical architects. For more information, see Understand invoice section.

The following tables show what role you need to complete tasks in the context of invoice sections.

Manage invoice section permissions and properties

Manage products for invoice section

Manage subscriptions for invoice section

Subscription billing roles and tasks

The following table shows what role you need to complete tasks in the context of a subscription.

Manage billing roles in the Azure portal

To assign billing roles, you might need to use a specific navigation path in the Azure portal. For example, to assign the subscription creator role, navigate to the invoice section and select it first and then select Access control (IAM).

1. Sign in to the Azure portal.
2. Search for Cost Management + Billing.
   
3. Select Access control (IAM) at a scope such as billing account, billing profile, invoice section, or subscription where you want to give access.
4. The Access control (IAM) page lists users and groups that are assigned to each role for that scope.
   
5. To give access to a user, Select + Add at the top of the page. On the Add role assignment page, select a role. Search for the user, group, or app to whom you want to give access. Select Add to assign the role.
   
6. To remove access for a user, select the user with the role assignment you want to remove. At the top of the page, select Remove.
   

Check access to a Microsoft Customer Agreement

To check the agreement type to determine whether you have access to a billing account for a Microsoft Customer Agreement, follow these steps:

1. Go to the Azure portal to check for billing account access. Search for and select Cost Management + Billing.
   
2. If you have access to just one billing scope, select Properties from the menu. You have access to a billing account for a Microsoft Customer Agreement if the billing account type is Microsoft Customer Agreement.
   
   If you have access to multiple billing scopes, check the type in the billing account column. You have access to a billing account for a Microsoft Customer Agreement if the billing account type for any of the scopes is Microsoft Customer Agreement.
   

Need help? Contact support

If you need help, contact support to get your issue resolved quickly.

Next steps

See the following articles to learn about your billing account:

• Get stated with your billing account for Microsoft Customer Agreement
• Create an Azure subscription for your billing account for Microsoft Customer Agreement