✅ How to Grant IAM Roles for Azure Cost Management Data Export

To successfully export Azure cost data to storage, both the user creating the export and the system-managed identity created by Azure need the correct roles. This ensures Azure can write to your storage account on schedule without permission errors.

👤 1. Grant Permissions to the User Creating the Export

The user (or service principal) setting up the export must be able to:

  • Create the export job
  • Assign roles to the managed identity

✅ Required Roles:

  • Owner of the subscription or storage account, or
  • Cost Management Contributor on the subscription plus
    User Access Administrator or custom role with Microsoft.Authorization/roleAssignments/write on the storage account

⚠️ Important:

  • If the storage account is firewalled or in another resource group, the user needs explicit permission at the storage scope.
  • Without these rights, the export setup will fail with an “Unauthorized” error when Azure tries to assign the managed identity’s role.

🆔 2. Grant Permissions to the Export’s Managed Identity

Azure creates a system-assigned managed identity for each export. This identity must have Storage Blob Data Contributor on the container where export data is stored.

🔄 Azure Will Do This Automatically If:

  • The user creating the export has permission to assign roles on the storage account.

🔧 If Not Assigned Automatically:

  1. Go to the export job and find the managed identity name (e.g., Export_<GUID>).
  2. Navigate to your storage account > Containers.
  3. Click Access Control (IAM) > Add Role Assignment.
  4. Assign Storage Blob Data Contributor to the export’s identity at the container scope.

🔁 3. If You Change or Delete the Export

When updating the destination or deleting the export:

  • Azure will attempt to remove the old role assignment.
  • The user must have Microsoft.Authorization/roleAssignments/delete permissions (included in Owner).

If Azure lacks this permission, manually remove the leftover role assignment via the portal or CLI.

✅ Summary

RoleWho Needs ItScope
Owner or Cost Management Contributor + User Access AdministratorPerson setting up the exportSubscription and Storage Account
Storage Blob Data ContributorExport’s managed identityContainer in the Storage Account

Once these roles are granted, Azure Cost Management can reliably write data to storage as scheduled.