Add the Enrollment Reader role to the Microsoft Azure service principal

  • Release version: Washingtondc
  • Updated February 12, 2025
  • 1 minute to read

    • Assign the Enrollment Reader role to the Azure EA application to retrieve billing, purchase, and pricing data. You can assign this role using a Microsoft API.

    Before you begin

    Role required: Enterprise administrator (EA)

    About this task

    Enrollment reader can view subscription charges related data at the enrollment, department, and account scopes. They can also view the Azure prepayment balance linked with the enrollment.

    Procedure

    1. Navigate to the Role Assignments - Put page in the Microsoft Azure documentation.
    2. Run the API by selecting the Try It button.
    3. Select Sign in.
    4. On the login page, enter your Microsoft Azure account credentials to sign in to the tenant.
    5. On the API request parameters form, fill in the fields.
      Table 1. Role Assignments API request parameters
      Field Description
      billingAccountName The Azure EA billing account ID.

      You can find the billing account ID on the Azure portal on the Cost Management + Billing overview page.
      billingRoleAssignmentName A unique ID to identify the name of the role that you want to assign.

      You can use a GUID generator website to generate a unique ID.
      Body The request body with parameters in JSON code. Enter the following JSON code in the body.

      { "properties": { "principalId": "{enterprise-application (or SPN) object-id}", "principalTenantId": "{tenant-id}", "roleDefinitionId": "/providers/Microsoft.Billing/billingAccounts/{ea-account-id}/billingRoleDefinitions/24f8edb6-1668-4659-b5e2-40bb5f3a7d7e" } }

      In this code, the principalID is the object ID of the EA application, principalTenantID is the tenant (directory) ID of the EA application, and roleDefinitionId is the ID of the role definition. 24f8edb6-1668-4659-b5e2-40bb5f3a7d7e is the role definition ID of the enrollment reader role. For details on the object ID and tenant ID, see Microsoft documentation.

      Important:
      Replace only the ea-account-id string with the actual EA billing account ID.
      Note:
      You must not change the values in the api-version and Content-Type fields.
    6. Complete the role assignment for the Azure EA application by selecting Run.