If you want someone to manage billing—like viewing invoices, managing billing profiles, or updating payment methods—without giving full ownership, you can assign them the Billing Account Contributor role. This role grants nearly full billing control (except for managing billing access).
🧭 1. Understand the Scope
Billing roles are assigned at one of two levels:
- Billing Account – applies across the organization (MCA accounts).
- Billing Profile – scoped to a single invoice (e.g., Invoice Manager).
To grant Billing Account Contributor, you’ll assign it at the billing account level. This is ideal for finance teams or accounting users who need broad billing access.
🔎 If you’re using an EA, roles like Enterprise Admin are assigned in the EA portal. The Billing Account Contributor role is for Microsoft Customer Agreement (MCA) or Pay-As-You-Go accounts.
🛠️ 2. Assign the Role in the Azure Portal
Step-by-Step:
- Go to the Azure Portal > Cost Management + Billing
- Select your Billing Account using the scope picker at the top (or click “Billing accounts” in the search bar).
- In the Billing Account view, click Access Control (IAM).
- Click + Add > Add role assignment
- In the Role dropdown, search for and select Billing account contributor
- Leave “Assign access to” as User, group, or service principal
- Select the user or group you want to assign the role to (e.g.
[email protected]) - Click Next > Review + assign
✅ Done! The user will now appear in the IAM list under that role.
🔐 What This Role Allows
A Billing Account Contributor can:
- View and download invoices
- Manage payment methods
- View cost analysis and budget data
- Update billing account settings (e.g. name, PO numbers, invoice contacts)
❌ They cannot:
- Assign or remove other billing roles
- Modify billing access permissions (only the Billing Account Owner can do that)
🧪 3. Verify Access
Ask the assigned user to log in and navigate to:
Azure Portal > Cost Management + Billing > Billing Account
They should now be able to see cost data, download invoices, and manage billing-related settings.
🖥️ Optional: Assign via CLI or PowerShell
If you prefer to assign the role programmatically:
Azure CLI:
bashCopyEditaz role assignment create \
--assignee [email protected] \
--role "Billing Account Contributor" \
--scope /providers/Microsoft.Billing/billingAccounts/{billingAccountId}
PowerShell:
powershellCopyEditNew-AzRoleAssignment `
-RoleDefinitionName "Billing Account Contributor" `
-ObjectId "<user objectId>" `
-Scope "/providers/Microsoft.Billing/billingAccounts/{billingAccountId}"
🧩 Related Roles
| Role | Scope | Purpose |
|---|---|---|
| Billing Account Reader | Billing Account | View-only access to billing data |
| Billing Profile Contributor | Billing Profile | Manage settings on a single invoice |
| Invoice Manager | Billing Profile | View and pay invoices only |
✅ Summary
Assigning the Billing Account Contributor role lets your finance or accounting team manage billing tasks without full Azure service access. It’s a best practice for role-based access control and financial operations in Azure.