Microsoft Entra ID · Remaining Built-in Roles
Billing Administrator
Can perform billing related tasks including purchases, subscription management, support tickets, and service health monitoring.
Scope: Organization-wide billing, subscription, and purchase management
Permissions
- Service Health - Manage Azure service health
- Support Tickets - Create Azure support tickets
- Billing - Full billing management
- Organization - Update organization properties
- M365 Health - Manage M365 service health
- Support Tickets - Create M365 support tickets
- Admin Center - Read admin center properties
- Purchases - Make purchases and manage subscriptions
- Payment - Update payment methods and billing information
- Invoices - View invoices and billing history
- Cost Management - Manage cost management and budgets
Common use cases
- Finance team managing Microsoft subscriptions
- Procurement staff handling license purchases
- Managing payment methods and invoices
- Subscription renewal management
- Cost management and optimization
- Budget tracking and forecasting
- Billing dispute resolution
- Invoice reconciliation
Best practices
- Assign to Finance or Procurement team members
- Separate from IT administration roles
- Implement purchase approval workflows
- Review subscription costs regularly
- Document purchase justifications
- Monitor for unexpected charges
- Coordinate with License Administrator for allocation
- Use PIM for elevated access
Security considerations
- Can make purchases affecting organizational costs
- Can modify payment information
- Can access billing and payment details
- Separate from technical admin roles
- Monitor for unauthorized purchases
- Alert on payment method changes
- Consider PIM for just-in-time access
Common questions
When should I assign the Billing Administrator role?
Assign Billing Administrator when you need to: Finance team managing Microsoft subscriptions; Procurement staff handling license purchases; Managing payment methods and invoices; Subscription renewal management; and Cost management and optimization. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Billing Administrator role do?
The Billing Administrator role grants permissions including: Service Health - Manage Azure service health; Support Tickets - Create Azure support tickets; Billing - Full billing management; Organization - Update organization properties; M365 Health - Manage M365 service health; and Support Tickets - Create M365 support tickets. See the Permissions section above for the full list.
What are the security risks of the Billing Administrator role?
Key considerations when assigning Billing Administrator: Can make purchases affecting organizational costs; Can modify payment information; Can access billing and payment details; and Separate from technical admin roles. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.