Welcome to this video on Azure Cost Management. Controlling
access to Cost Management Data. My name is Terry Clancy. In
this video I will provide a quick overview on how
organizations can control access to cloud cost management data.
access control can be used to ensure that users can access
billing and cost management data based on their specific roles
and can perform specific actions based on those roles. Azure
Cost Management is a native Azure Service designed to allow
customers and partners to gain complete visibility and control
of their cloud costs across Azure and Amazon Web Services.
Access Control is the best way to provide granular access to
billing and cost management data for the various roles to perform
their specific tasks while preventing access to other data
and functions. Access is controlled for users by
assigning roles for those users for particular scopes. A role
definition is a selection of permissions. It is typically
just called a role. A role definition lists the operations
that can and cannot be performed. Rolls can be applied
to users or more generally, security principles which
include, for example, groups. Roles are applied to users for a
scope. For example a single resource or a resource group or
a whole subscription or a management group. Let's look at
how these are used in Azure Cost Management. Let's start by
looking at scopes.
A scope is a node in the Azure entity hierarchy where Azure
Active Directory users access and manage services. In Azure
Cost Management. You select your scope of interest using the
Scope Picker tool. When access is granted to a
particular scope. For example here trade research, then the
branch of nested nodes below that can be accessed and
managed. So scopes defined for which entities you can manage
billing data, view invoices and costs and conduct general
account management. Microsoft offers two hierarchies above Azure
subscriptions that have specialized roles to manage
billing data. The resource entity hierarchy and the billing
entity hierarchy. The resource entity hierarchy consists of a
hierarchy of management groups, subscriptions, resource groups,
and resources as you can see here. Above subscriptions there
is a separate billing entity hierarchy. It varies depending
on the channel or offer being used. For example, here it is
for Enterprise Agreement.
Or EA customers. EA billing accounts, also called
enrollments. Have three billing scopes. The billing account,
which Maps to EA enrollments and related invoices, Department
scopes, which is an optional grouping of enrollment accounts,
and enrollment account scopes, which represents a single
account owner who can create subscriptions. Microsoft
Customer Agreement or MCA customers will see a different
billing hierarchy as shown here. MCA customers have three billing
scopes. The billing account represents a customer agreement
for multiple Microsoft products and services. Billing profiles
map to invoices. You can have different invoices in different
currencies under a single billing account. Invoice
sections are a way to break an invoice into groups of
subscriptions. Edge can have separate permissions assigned to
different people. Cloud solution providers or CSP's only will
also see a customer scope which is a group of subscriptions that are
associated to a specific
customer. Let's move on from scopes and look at the roles
which are relevant for Cost Management. We'll start by looking
at the roles used for Resource Entities and then Billing
Entities. In most cases the simplest and best way to grant
users access or permissions to Azure cost management data is to
assign a role based access control or RBAC role. These
are applied to resource entity scopes or RBAC scopes, which
is what we see if we drill down from the root management group
in this branch of the scope
selector. RBAC permissions apply for the node for which they were
granted and the whole branch of Nested nodes underneath of that.
In the resource entity hierarchy. So to assign RBAC
roles, first select the scope for which you want permissions
to apply. This will typically be management group subscription,
or resource group. Then click on the access control option on the
left. That brings up the access control blade. In this blade you
can now choose add a role assignment and in the add role
assignment blade, choose the role you want to assign for ACM
access. In this case we will assign the cost management
contributor role and then pick the user or groups to assign the
role and related permissions to. Now, once you click save, the
selected users now with the roles they were assigned, can
perform the appropriate tasks. In this way RBAC is then used
by the Azure Cost Management service to grant or deny
permissions to specific roles within an organization,
to perform cost management related activities. Azure Cost
Management adds 2 new Cost Management specific RBAC roles.
The cost management reader role, which gives users read access to
the cost management data at the specified scope and all levels
below that scope and the cost management contributor role,
which not only gives users the rights to view cost data, but
also the rights to manage costs configuration. For example, they
can change budgets and alert
thresholds. Note that cost management contributors might
also require additional roles to support end to end cost
management scenarios. For example, assigning the
monitoring contributor role for a resource group that contains
an Action Group will allow the user to configure actions to be
performed when budgets are exceeded. Also, you will need
the storage account contributor role to export costs to a
storage account and to take actions on cost
recommendations, it will require whatever service specific role
is required for the service in question. Now let's look at an
example of how RBAC can be used. Carol, in this case, is an
admin owner and can view and configure cost management
details at the root level Management Group and all
worldwide child management groups underneath it. John, on
the other hand, works for the oil subsidiary in the Americas, and
has been given cost management, contributed privileges for the
production management group
in that branch. That includes all subscriptions and resource
groups underneath that scope. He can control cost management
related configuration activities for that scope. That includes
setting budgets, configuring alerts, and creating exports.
Finally, Adam is a developer in the mining subsidiary in the
USA. He has only ACM reader privileges for the development
management group, so he can see or view ACM data for all
subscriptions and resource
groups under this management group, but he cannot change
budgets or configure alerts.
Let's now look at roles that apply to billing entities or
billing scopes, which is what we see if we drill down from
billing account in this branch of the scope selector. In this
case, for an EA we see billing account at the top level and
then Department and then enrollment accounts. Permissions
for these billing entities are controlled by billing and
account roles which can be configured in the EA portal at
ea.azure.com. For this video, we will focus the scope discussions
to cover enterprise agreements and the new Microsoft customer
agreements or MCA offers. These offers each have different
billing entities and scopes associated with them. But note
that the resource entities remain the same across all
offers. Let's look first at Enterprise Agreements or EA
scopes and rolls. Although governance or resource scopes
are bound to a single directory, EA billing scopes are not.
And EA billing account may have subscriptions across any number
of Azure AD directories. EA billing scopes support the roles
you can see listed here. But for summary of their related
permissions These are, Enterprise Admin, Enterprise
read-only, Department Admin, Department read-only and account
owner. Let's take a quick look at how to use the EA portal to
assign these roles to users. The EA portal is at
ea.azure.com to add or edit enterprise admins. First click
on enrollment. Then to add administrator, click on add
administrator or to edit an administrator, hover over an
existing admin and click on the pen icon that will appear. To add
EA departments and Department admins, first click on
Department then click on add Department to create a new
Department. And click on add administrator to add an admin to
an existing Department. To add enrollment accounts, first click
on account. Then click on add account. EA customers also need
to enable access for any user with any role to view costs. The
Department scope requires a DA or Department Admin, view charges
option enabled. All other scopes require the AO or account owner
view charges option enabled. This can be done either in the
EA portal or on the Azure Portal as shown here. Now let's look at
Microsoft customer agreement or MCA billing accounts.
Unlike EA billing scopes MCA billing accounts are bound to a
single directory and can't have subscriptions across multiple
Azure AD the directory's MCA billing scopes support the
following roles which you can see listed here with a summary
of their related permissions. These are: owner, contributor
reader, invoice manager and Azure subscription creator. Let's take
a quick look at how to use the Azure portal to assign these
roles to users.
In Azure Cost Management, set your scope to billing account,
billing profile or invoice section. Then select access
control (IAM) click add, select a role and enter the users email
address. Beyond EA and MCA. Other customers can also use ACM.
In the case of pay as you go or PAYG customers. There are no
additional billing scopes. You should use RBAC Scopes and
rolls. For cloud solution providers or CS Ps
And Amazon Web Services or AWS customers see the links on this
page For more information. In conclusion, access control and
management for cloud resources is a critical function for any
organization that's using the cloud. RBAC combined with
billing rolls, scopes and permissions helps you manage who
has access to Azure Resources and what they can do with those
resources. Azure Cost Management users access control to grant or
deny access to scoped Cost
management data. And provide the right level of access to users
based on their roles. Thanks for watching and please see our other
videos in the Azure Cost Management channel on YouTube
for other ACM related videos.