Azure Management and governance built-in role
Savings plan Purchaser
Purchases Azure compute savings plans and reads related billing, consumption, reservation, and savings-plan information. It does not manage workload resources or provide data-plane access.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 3d24a3a0-c154-4f6f-a5ed-adc8e01ddb74
Control-plane actions (10)
Microsoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Capacity/register/actionMicrosoft.Capacity/catalogs/readMicrosoft.Authorization/roleAssignments/readMicrosoft.BillingBenefits/savingsPlanOrders/writeMicrosoft.BIllingBenefits/register/actionMicrosoft.Support/supporttickets/writeMicrosoft.Billing/billingProperty/readMicrosoft.CostManagement/benefitRecommendations/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign according to the eligible billing profile or account and subscription context documented for the agreement. Savings-plan purchase and management use billing-provider scopes that are distinct from ordinary resource-group inheritance.
Common use cases (2)
- Purchase an approved compute savings plan commitment for eligible usage.
- Read the savings-plan and billing context required to validate and complete an authorized purchase.
Prerequisites (2)
- Confirm billing agreement eligibility, hourly commitment, term, payment method, benefit scope, permissions, and finance approval.
- Analyze stable eligible compute usage and compare the plan with reservations before purchase.
Best practices (2)
- Assign to a small procurement or FinOps group and require a documented approval for each hourly commitment.
- Review utilization and benefit scope after purchase and avoid commitments based on short-lived or uncertain usage.
Security considerations (2)
- A purchase creates a financial commitment and can produce waste if the hourly commitment or scope is wrong.
- The role reads sensitive billing and usage information but has no DataActions or workload modification rights.
Assignment guidance
Assign only to authorized savings-plan purchasers in the applicable billing context. Require finance approval per purchase and use read-only billing or cost roles for analysis without commitment authority.
Related roles (1)
- Reservation Purchaser: Separate purchase authority for reservations rather than compute savings plans.
Common questions
When should I assign the Savings plan Purchaser Azure role?
Assign Savings plan Purchaser when you need to: Purchase an approved compute savings plan commitment for eligible usage.; and Read the savings-plan and billing context required to validate and complete an authorized purchase.. Practical scope: Assign according to the eligible billing profile or account and subscription context documented for the agreement. Savings-plan purchase and management use billing-provider scopes that are distinct from ordinary resource-group inheritance.
What permissions does the Savings plan Purchaser Azure role grant?
The role definition grants 10 combined control-plane and data-plane actions. Representative operations include: Microsoft.Resources/subscriptions/read; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Capacity/register/action; Microsoft.Capacity/catalogs/read; Microsoft.Authorization/roleAssignments/read; and Microsoft.BillingBenefits/savingsPlanOrders/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Savings plan Purchaser Azure role?
Key considerations when assigning Savings plan Purchaser: A purchase creates a financial commitment and can produce waste if the hourly commitment or scope is wrong.; and The role reads sensitive billing and usage information but has no DataActions or workload modification rights.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Permissions to view and manage savings plans →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Buy a savings plan →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.