Azure Management and governance built-in role

Reservations Reader

Reads reservation orders and reservations at the tenant-level Microsoft.Capacity provider scope. It cannot purchase, exchange, refund, split, merge, renew, or change reservation scope and has no DataActions.

Control-plane actions (2)

• Microsoft.Capacity/*/read
• Microsoft.Authorization/roleAssignments/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /providers/Microsoft.Capacity

Practical scope

The built-in role is assignable only at `/providers/Microsoft.Capacity`, a tenant/provider scope rather than a management group, subscription, resource group, or resource. It provides read access to all reservations in the tenant.

Common use cases (2)

• Inventory tenant reservations, orders, utilization context, terms, quantities, and scope settings.
• Provide FinOps, finance, audit, or capacity teams read-only visibility across reservation commitments.

Prerequisites (2)

• The administrator must intentionally grant access at the tenant Microsoft.Capacity provider scope.
• Confirm that the principal is authorized to view reservations across the entire tenant.

Best practices (2)

• Use a dedicated tenant FinOps or audit group and review membership regularly.
• Do not substitute the provider scope with a subscription assignment, which does not represent the same tenant-wide reservation view.

Security considerations (2)

• Tenant-wide reservation information reveals financial commitments, product usage, terms, and organizational purchasing patterns.
• The role is read-only and has no DataActions, but its provider scope is broader than one subscription.

Assignment guidance

Assign at `/providers/Microsoft.Capacity` only to principals authorized for tenant-wide reservation visibility. Use Reservation Purchaser separately for approved purchasing.

Related roles (1)

• Reservation Purchaser: Adds authority to purchase reservations.

Editorial sources (5)

• Azure built-in roles for Management and governance →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Permissions to view and manage Azure reservations →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →