Azure billing API permissions needed?

Question

I'm trying to retrieve the ratecard and usage thru the Azure API. I've created an Azure AD Application, and gave it permission to the 'Microsoft Azure Active Directory' and 'Windows Azure Service Management API'.

I've created an Azure AD user and gave it 'Owner' rights on the AD Application.

I'm able to do an Oath2 athentication and reveice an token. But when I try to access the ratecard API, I get the following permissions error:

{  
   "error":{  
      "code":"AuthorizationFailed",
      "message":"The client 'api-user@contoso.onmicrosoft.com' with object id 'xxxxxxxx-xxxx-xxxx-xxx-xxxxxxx' does not have authorization to perform action 'Microsoft.Commerce/RateCard/read' over scope '/subscriptions/xxxxxx-xxxxx-xxxx-xxxxx-xxxxxxxxx'."
   }
}

I think I need to allow the Azure AD user to access the ratecard API, but I'm unable to find out how. Hope someone can help me out.

Answer 1

You could try adding a custom role to your subscription and give it the permission as follows:

Microsoft.Commerce/RateCard/read 

Then assign this role to your application...

Answer 2

Your reply got me thinking. In the Azure portal I went to my Subscription / Access control (IAM). I added an entry to my Azure AD user with the existing role of "Billing Reader". And now I'm able to successfully read out the billing API's. Thanks!