Azure Management and governance built-in role
Cost Management Reader
Reads cost and usage data and Cost Management configuration, including budgets and exports, without changing that configuration. It also reads Advisor recommendations and Azure hierarchy information and has no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 72fafb9e-0641-4937-9268-a91bfd8191a3
Control-plane actions (10)
Microsoft.Consumption/*/readMicrosoft.CostManagement/*/readMicrosoft.Billing/billingPeriods/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*Microsoft.Advisor/configurations/readMicrosoft.Advisor/recommendations/readMicrosoft.Management/managementGroups/readMicrosoft.Billing/billingProperty/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the Azure management group, subscription, or resource group whose costs the principal must inspect. Parent assignments inherit to child scopes; billing-account and billing-profile access use provider-specific billing roles rather than this Azure hierarchy alone.
Common use cases (2)
- Analyze costs, forecasts, budgets, exports, and allocation for an Azure scope without changing settings.
- Provide finance, FinOps, audit, or workload owners with cost visibility for their responsibility boundary.
Prerequisites (2)
- Identify the Azure or billing scope that contains the required cost data.
- Confirm the principal needs configuration visibility but not budget or export changes.
Best practices (2)
- Assign at the narrowest reporting scope and use management-group scope only for organization-wide FinOps teams.
- Keep financial exports and detailed usage data in approved destinations with separate access control.
Security considerations (2)
- Cost data reveals resource usage, spend, service mix, and organizational structure.
- The role has no Cost Management writes or DataActions and cannot modify billed resources.
Assignment guidance
Assign to analysts and stakeholders at the cost scope they are authorized to view. Escalate to Cost Management Contributor only for approved budget, export, or configuration changes.
Related roles (1)
- Cost Management Contributor: Adds budget, export, and Cost Management configuration changes.
Common questions
When should I assign the Cost Management Reader Azure role?
Assign Cost Management Reader when you need to: Analyze costs, forecasts, budgets, exports, and allocation for an Azure scope without changing settings.; and Provide finance, FinOps, audit, or workload owners with cost visibility for their responsibility boundary.. Practical scope: Assign at the Azure management group, subscription, or resource group whose costs the principal must inspect. Parent assignments inherit to child scopes; billing-account and billing-profile access use provider-specific billing roles rather than this Azure hierarchy alone.
What permissions does the Cost Management Reader Azure role grant?
The role definition grants 10 combined control-plane and data-plane actions. Representative operations include: Microsoft.Consumption/*/read; Microsoft.CostManagement/*/read; Microsoft.Billing/billingPeriods/read; Microsoft.Resources/subscriptions/read; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Support/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Cost Management Reader Azure role?
Key considerations when assigning Cost Management Reader: Cost data reveals resource usage, spend, service mix, and organizational structure.; and The role has no Cost Management writes or DataActions and cannot modify billed resources.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Understand and work with scopes in Cost Management →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.