I need to use an Azure Bicep template to assign the Reservation Reader and Savings Plan Reader roles. I'm not trying to purchase a reservation or savings plan; I only want to grant read access for different billing agreement types, such as CSP, MCA, and EA. For an MCA setup, the billing account may not be available in the deployment context, so I may need to assign access at the individual billing-profile scope. Is this supported with Bicep, and what scope should be used?
2 Answers
The scope matters more than the role name here. A subscription or resource-group scope generally won’t grant access to reservation or savings-plan billing data. For MCA, try using the billing profile resource ID as the role-assignment scope when the billing account isn’t available. The deployment identity also needs permission to create role assignments at that billing scope, and the required built-in role may differ between reservations and savings plans.
Bicep can create role assignments, but purchasing reservations or savings plans is a separate operation and isn’t handled by a normal Bicep deployment. For read access, the key issue is the scope: the role assignment must target a billing account, billing profile, or the specific reservation or savings-plan resource, depending on which resource types and permissions are exposed for that agreement. If the billing scope can’t be resolved in the deployment, use the appropriate billing-scope resource ID as an existing resource or perform the assignment through the CLI or REST API in your deployment pipeline.
I’m not purchasing anything. I need to grant readers access across CSP, MCA, and EA billing arrangements, and for MCA I may need to assign the role separately at each billing-profile scope.
If the billing profile cannot be referenced by the Bicep deployment, the practical fallback is to resolve its ID first and run the role assignment through Azure CLI or the management REST API.