Limited IAM Permissions for Azure Active Discount Management - Microsoft Customer Agreement

To actively manage your portfolio of Reservations and Savings Plans for Azure services, we require additional IAM permissions beyond those necessary for the Savings Analysis. These additional roles allow ProsperOps to purchase and modify Azure discount instruments and update quotas. All roles added to the App Registration when it was originally created for the Savings Analysis should stay in place.

• At no point in time do these roles grant us access to:
  • The Azure data plane (e.g., instances, clusters, containers)
  • Manipulate the Azure control plane (e.g., start or terminate an instance, cluster, or task)
  • Your data, whether local or in a managed storage/datastore service
• These additional permissions will allow us to:
  • Purchase, exchange, and manage discount instruments on your behalf
  • Identify the optimal subscription for purchasing commitments

Required Roles

• Billing Profile Contributor on the billing profile
• Reservations Purchaser on the root management group
• Savings Plan Purchaser on the root management group
• Quota Request Operator on the root management group
• ProsperOps Custom Role on the root management group
• Reservations Administrator on the tenant where the ProsperOps service principal is located

Role Details

• Billing Profile Contributor on the billing profile
  
  • What this role can do:
  • Manage all reservation and savings plan purchases made using the billing profile
  • Purchase savings plans from the Cost Management + Billing experience for the billing profile
  • Manage invoices and payments for the billing profile
  • What this role cannot do:
  • Assign roles to other users (that requires Billing Profile Owner)
  • Access the data plane or your workload resources
  • Why we need it:
  • This lets us purchase and manage reservations and savings plans that are billed to your billing profile.

• Reservations Purchaser on the root management group
  • What this role can do:
    • Purchase reservations against a specified subscription
  • What this role cannot do:
    • Manage or delegate reservations at the tenant level (that requires Reservations Administrator or Contributor)
  • Why we need it:
    • This grants the ability to purchase reservations. Assigning it at the root management group ensures the permission applies across all current and future subscriptions we may use as the purchasing subscription.
• Savings Plan Purchaser on the root management group
  • What this role can do:
    • Purchase savings plans against a specified subscription
  • What this role cannot do:
    • Manage or delegate savings plans at the tenant level
  • Why we need it:
    • This grants the ability to purchase savings plans. Assigning it at the root management group ensures the permission applies across all current and future subscriptions.
• Quota Request Operator on the root management group
  • What this role can do:
    • Read and create quota requests, get quota request status, and create support tickets
    • Quota Request Operator includes the following permissions:
      • Microsoft.Capacity/resourceProviders/locations/serviceLimits/read
      • Microsoft.Capacity/resourceProviders/locations/serviceLimits/write
      • Microsoft.Capacity/resourceProviders/locations/serviceLimitsRequests/read
      • Microsoft.Capacity/register/action
      • Microsoft.Quota/usages/read
      • Microsoft.Quota/quotas/read
      • Microsoft.Quota/quotas/write
      • Microsoft.Quota/quotaRequests/read
      • Microsoft.Quota/register/action
      • Microsoft.Authorization/*/read
      • Microsoft.Insights/alertRules/*
      • Microsoft.Resources/deployments/*
      • Microsoft.Resources/subscriptions/resourceGroups/read
  • What this role cannot do:
    • Access, create, or modify workload resources or data
    • Access billing or cost data
  • Why we need it:
    • Before a reservation or savings plan purchase can be applied, the target subscription must have sufficient quota (e.g., vCPU cores) for the relevant VM family and region. This role lets ProsperBot read current quota utilization and submit quota increase requests programmatically so purchases don't fail on capacity limits.
• ProsperOps Custom Role on the root management group
  
  • What this role can do:
    • Register resource providers on subscriptions under the root management group
    • Read which providers are currently registered
    • ProsperOps Custom Role includes the following permissions:
      • Microsoft.Capacity/register/action
      • Microsoft.Sql/register/action
      • Microsoft.DBforMySQL/register/action
      • Microsoft.DBforPostgreSQL/register/action
      • Microsoft.Resources/subscriptions/providers/read

• • What this role cannot do:
    • Access, create, or modify any data or resources of the specified type
    • Access billing or cost data
    • Read or modify data within any service
  • Why we need it:
    • ProsperBot needs to know which SKUs (VM sizes, database tiers, etc.) are available in each subscription to determine the optimal action subscription to use when purchasing commitments. Reading SKU catalogs requires the relevant resource provider to be registered first. Rather than manually adding register providers on every existing and future subscription, this role lets ProsperBot do it programmatically as needed.
    • We use a custom role instead of built-in roles like Contributor or Owner specifically to keep these permissions as narrow as possible.
• Reservations Administrator on the tenant where the ProsperOps service principal is located
  • What this role can do:
    • Read and manage all reservations in the tenant, and delegate reservation RBAC roles to other users
    • Reservations Administrator includes the following permissions:
      • Microsoft.Capacity/*/read
      • Microsoft.Capacity/*/action
      • Microsoft.Capacity/*/write
      • Microsoft.Authorization/roleAssignments/read
      • Microsoft.Authorization/roleAssignments/write
      • Microsoft.Authorization/roleAssignments/delete
      • Microsoft.Authorization/roleDefinitions/read
  • What this role cannot do:
    • Access the data plane or manipulate your workload resources
    • Access your data in any managed storage or datastore service
  • Why we need it:
    • This role is scoped at the tenant level (/providers/Microsoft.Capacity) and lets us view and manage the full set of reservations across the tenant since reservations are tenant-level resources. Reservations do not inherit subscription permissions after purchase. This is what allows us to exchange, re-scope, and actively manage the discount instruments we purchase on your behalf.