Azure Management and governance built-in role
Billing Reader
Reads subscription billing data and related cost, usage, reservation, and support information exposed by the built-in definition. It is Azure Resource Manager control-plane access and does not grant authority at every billing-account, billing-profile, invoice-section, or customer scope.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: fa23ad8b-c56e-40d8-ac0c-ce449e1d2c64
Control-plane actions (7)
Microsoft.Authorization/*/readMicrosoft.Billing/*/readMicrosoft.Commerce/*/readMicrosoft.Consumption/*/readMicrosoft.Management/managementGroups/readMicrosoft.CostManagement/*/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the subscription when subscription billing visibility is required. Billing-account agreement types also have provider-specific billing roles and scopes, so a subscription Billing Reader assignment must not be represented as tenant-wide or billing-account-wide access.
Common use cases (2)
- Allow finance, FinOps, or audit staff to inspect subscription charges, usage, invoices exposed at subscription scope, and reservation information.
- Support cost reconciliation without permitting budget, export, reservation purchase, or resource changes.
Prerequisites (2)
- Confirm that the required data is available at subscription scope and identify the applicable billing agreement and billing hierarchy.
- Use a billing-account or profile role instead when the task belongs to that provider-specific billing scope.
Best practices (2)
- Assign only on subscriptions whose financial data the principal is authorized to view.
- Separate billing visibility from Cost Management configuration and purchase authority.
Security considerations (2)
- Billing and usage data can reveal spend, resource consumption, subscription structure, and business activity.
- The role has no DataActions and cannot change resources, but it also includes support-ticket visibility in the assigned scope.
Assignment guidance
Assign Billing Reader at the subscription for read-only financial review. Use provider-specific billing roles for billing-account hierarchy access, Cost Management Reader for cost-analysis configuration, and separate purchaser roles for commitments.
Related roles (2)
- Cost Management Reader: Reads Cost Management data and configuration such as budgets and exports.
- Reservations Reader: Tenant-level reservation read role at the Microsoft.Capacity provider scope.
Common questions
When should I assign the Billing Reader Azure role?
Assign Billing Reader when you need to: Allow finance, FinOps, or audit staff to inspect subscription charges, usage, invoices exposed at subscription scope, and reservation information.; and Support cost reconciliation without permitting budget, export, reservation purchase, or resource changes.. Practical scope: Assign at the subscription when subscription billing visibility is required. Billing-account agreement types also have provider-specific billing roles and scopes, so a subscription Billing Reader assignment must not be represented as tenant-wide or billing-account-wide access.
What permissions does the Billing Reader Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Billing/*/read; Microsoft.Commerce/*/read; Microsoft.Consumption/*/read; Microsoft.Management/managementGroups/read; and Microsoft.CostManagement/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Billing Reader Azure role?
Key considerations when assigning Billing Reader: Billing and usage data can reveal spend, resource consumption, subscription structure, and business activity.; and The role has no DataActions and cannot change resources, but it also includes support-ticket visibility in the assigned scope.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Understand and work with scopes in Cost Management →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Permissions to view and manage Azure reservations →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.