Azure Management and governance built-in role
Reservations Reader
Reads reservation orders and reservations at the tenant-level Microsoft.Capacity provider scope. It cannot purchase, exchange, refund, split, merge, renew, or change reservation scope and has no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 582fc458-8989-419f-a480-75249bc5db7e
Control-plane actions (2)
Microsoft.Capacity/*/readMicrosoft.Authorization/roleAssignments/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/providers/Microsoft.Capacity
Practical scope
The built-in role is assignable only at `/providers/Microsoft.Capacity`, a tenant/provider scope rather than a management group, subscription, resource group, or resource. It provides read access to all reservations in the tenant.
Common use cases (2)
- Inventory tenant reservations, orders, utilization context, terms, quantities, and scope settings.
- Provide FinOps, finance, audit, or capacity teams read-only visibility across reservation commitments.
Prerequisites (2)
- The administrator must intentionally grant access at the tenant Microsoft.Capacity provider scope.
- Confirm that the principal is authorized to view reservations across the entire tenant.
Best practices (2)
- Use a dedicated tenant FinOps or audit group and review membership regularly.
- Do not substitute the provider scope with a subscription assignment, which does not represent the same tenant-wide reservation view.
Security considerations (2)
- Tenant-wide reservation information reveals financial commitments, product usage, terms, and organizational purchasing patterns.
- The role is read-only and has no DataActions, but its provider scope is broader than one subscription.
Assignment guidance
Assign at `/providers/Microsoft.Capacity` only to principals authorized for tenant-wide reservation visibility. Use Reservation Purchaser separately for approved purchasing.
Related roles (1)
- Reservation Purchaser: Adds authority to purchase reservations.
Common questions
When should I assign the Reservations Reader Azure role?
Assign Reservations Reader when you need to: Inventory tenant reservations, orders, utilization context, terms, quantities, and scope settings.; and Provide FinOps, finance, audit, or capacity teams read-only visibility across reservation commitments.. Practical scope: The built-in role is assignable only at `/providers/Microsoft.Capacity`, a tenant/provider scope rather than a management group, subscription, resource group, or resource. It provides read access to all reservations in the tenant.
What permissions does the Reservations Reader Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.Capacity/*/read; and Microsoft.Authorization/roleAssignments/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Reservations Reader Azure role?
Key considerations when assigning Reservations Reader: Tenant-wide reservation information reveals financial commitments, product usage, terms, and organizational purchasing patterns.; and The role is read-only and has no DataActions, but its provider scope is broader than one subscription.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Permissions to view and manage Azure reservations →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.