Not able to Access Billing info using Azure CLI

Question

I created a service principal using rbac and using the subscription id and I was able to login and all CLI calls with Azure using this sp and this login

(creating SP az ad sp create-for-rbac -n "AppName1" --role contributor --scopes /subscriptions//resourceGroups/)

But when I call for billing info as: az consumption usage list --subscription Unauthorized. Request ID:

I am not sure what authentication permission scope to add to enable this. Tried too many things and somehow I feel I am not in the right direction. Any help will be greatly appreciated.

Did you add the Billing Reader role to the Service Principal? — Daniel Björk, Jul 31 '20 at 07:38

score 1 · Answer 1 · answered Jul 31 '20 at 07:25

1

Did you login with the service principle using the following command before hitting the billing/usage?

az login --service-principal -u <app-url> -p <password-or-cert> --tenant <tenant>

answered Jul 31 '20 at 07:25

A Modgil

260
1
7

Gaurav Mantri · Answer 2 · 2020-08-01T13:09:14.790

1

I believe the issue is that you assigned the “contributor” role at the resource group level and then trying to access a subscription level resource. Since you don’t have permission for that, you’re getting this “Unauthorized” error.

To fix this, please try to assign the “contributor” role at the subscription level for this service principal.

edited Aug 01 '20 at 13:09

answered Jul 31 '20 at 08:13

Gaurav Mantri

128,066
12
206
241

Yes, this fixed the issue. Needed to add the Role Contributor for the SP also. Thanks – Manjunath M Gowda Aug 01 '20 at 03:19

Not able to Access Billing info using Azure CLI

2 Answers2