New-AzRoleAssignment to assign Billing account reader role to billing account

Sean Belling 1 Reputation point
2020-11-18T17:26:02.713+00:00

Hi,
I'm reading through the docs (https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azroleassignment?view=azps-5.1.0) and have tried multiple commands but am unsure how to do it correctly, or if it is even possible to assign the Billing Account Reader role to a service principal application through the New-AzRoleAssignment PowerShell command. Everything I see in the docs there for the -Scope parameter seems to indicate that it's only possible at the subscription and below level.
I am able to add this role manually through the Azure portal UI but would like to be able to script this

Thanks,
Sean

Azure Cost Management
Azure Cost Management
A Microsoft offering that enables tracking of cloud usage and expenditures for Azure and other cloud providers.
2,075 questions
Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
675 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,456 Reputation points Microsoft Employee
    2020-11-18T21:09:25.58+00:00

    @Sean Belling
    Thank you for your post! You can add the Billing Reader role to your service principle by following the below steps.

    1.Get the ObjectID of your Service Principle - For more info.

    #This will list all service principles  
Get-AzureADServicePrincipal

    2.Run the New-AzRoleAssignment command specifying the ObjectID of your Service Principle - For more info.

    New-AzRoleAssignment -ObjectId "servicePrincpleObjectID" -RoleDefinitionName "Billing Reader"

    40922-image.png
    Billing Reader role

    I hope this helps! If you have any other questions, please let me know.
    Thank you for your time and patience throughout this issue.

    0 comments
  2. Sean Belling 1 Reputation point
    2020-11-18T21:36:09.63+00:00

    Hi, thanks that's helpful for adding the role
    What I'm wondering was though if it is possible to add that role at the Billing Account scope, so something like this command
    New-AzRoleAssignment -ObjectId "servicePrincpleObjectID" -RoleDefinitionName "Billing Reader" -Scope /bilingAccount/<billingAccountId> ?
    I see in your example the scope parameter wasn't included so the command defaulted to the current subscription scope

    thanks