Azure Management and governance built-in role
Cost Management Contributor
Views cost and usage data and manages Cost Management configuration such as budgets and exports. Its control-plane permissions also read Advisor recommendations and hierarchy information and create or manage support tickets, but do not grant authority to change billed resources or purchase reservations and savings plans.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 434105ed-43f6-45c7-a02f-909b2ba83430
Control-plane actions (10)
Microsoft.Consumption/*Microsoft.CostManagement/*Microsoft.Billing/billingPeriods/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*Microsoft.Advisor/configurations/readMicrosoft.Advisor/recommendations/readMicrosoft.Management/managementGroups/readMicrosoft.Billing/billingProperty/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Cost Management supports Azure RBAC scopes such as management group, subscription, and resource group plus provider-specific billing scopes. An Azure RBAC assignment inherits down the Azure resource hierarchy; billing-account roles are separate and depend on the agreement type.
Common use cases (2)
- Create and maintain budgets, alerts, exports, and cost-analysis configuration for an approved Azure scope.
- Operate a FinOps workflow that needs both cost visibility and Cost Management configuration changes without resource administration.
Prerequisites (2)
- Identify the cost scope and billing agreement that owns the data and configuration.
- Configure export destination permissions separately when cost exports write to a storage account.
Best practices (2)
- Assign at the management group, subscription, or resource group matching the FinOps responsibility and review inherited access.
- Separate cost configuration from commitment purchase and resource-change authority.
Security considerations (3)
- The role exposes detailed spend and usage and can alter budgets, alerts, exports, and cost configuration.
- Export changes can redirect financial data to an approved destination the principal controls; destination data permissions remain separate.
- It has no DataActions and cannot purchase commitments or modify workload resources.
Assignment guidance
Assign to FinOps administrators at the cost-management scope they own. Use Cost Management Reader for analysis-only users and separate Reservation or Savings plan Purchaser roles for approved commitments.
Related roles (3)
- Cost Management Reader: Read-only counterpart for cost data and configuration.
- Reservation Purchaser: Separate authority to purchase reservations.
- Savings plan Purchaser: Separate authority to purchase savings plans.
Common questions
When should I assign the Cost Management Contributor Azure role?
Assign Cost Management Contributor when you need to: Create and maintain budgets, alerts, exports, and cost-analysis configuration for an approved Azure scope.; and Operate a FinOps workflow that needs both cost visibility and Cost Management configuration changes without resource administration.. Practical scope: Cost Management supports Azure RBAC scopes such as management group, subscription, and resource group plus provider-specific billing scopes. An Azure RBAC assignment inherits down the Azure resource hierarchy; billing-account roles are separate and depend on the agreement type.
What permissions does the Cost Management Contributor Azure role grant?
The role definition grants 10 combined control-plane and data-plane actions. Representative operations include: Microsoft.Consumption/*; Microsoft.CostManagement/*; Microsoft.Billing/billingPeriods/read; Microsoft.Resources/subscriptions/read; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Support/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Cost Management Contributor Azure role?
Key considerations when assigning Cost Management Contributor: The role exposes detailed spend and usage and can alter budgets, alerts, exports, and cost configuration.; Export changes can redirect financial data to an approved destination the principal controls; destination data permissions remain separate.; and It has no DataActions and cannot purchase commitments or modify workload resources.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Understand and work with scopes in Cost Management →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.