Missing Reservations or Savings Plans Data in Quantum Azure
During the Quantum Azure onboarding process, it is possible for the Quantum application to be set up successfully but also to be missing access to the tenant’s Reservations or Savings Plan data.
This can occur when the account that was used to set up Quantum did not have the necessary permissions to grant Quantum read access to the Reservations or Savings Plans and can lead to inaccurate recommendations being made by the portal.
If you have found that your Quantum reports are missing Reservation Orders and/or Savings Plans, the following steps can be used to grant Quantum the necessary read access via RBAC roles in the Azure portal.
Pre-requisites
This guide will need to be followed by an Azure administrator user with the following roles:
- Reservation Administrator OR Global Admin with User Access Administrator role
- Savings Plan Administrator OR Global Admin with User Access Administrator role
Granting Reservation Order read access
1. Sign in to the Azure portal with an appropriate administrator account - https://portal.azure.com/
2. Go to Reservations and select Role Assignment:
3. Select Add -> Role Assignment
4. Select “Reservation Reader" role and add the Quantum SPN as a member:
5. Click "Review + Assign" to grant the role to the Quantum application
If the option to add a new role assignment is disabled in the GUI, the following PowerShell script can be used instead:
Import-Module Az.Accounts
Import-Module Az.Resources
Connect-AzAccount -Tenant <TenantId>
New-AzRoleAssignment -Scope "/providers/Microsoft.Capacity" -PrincipalId <ObjectId> -RoleDefinitionName "Reservations Reader"
https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/view-reservations#assign-a-reservation-reader-role-at-the-tenant-level-using-azure-powershell-script
Granting Savings Plans read access
1. Sign in to the Azure portal with an appropriate administrator account - https://portal.azure.com/
2. Go to Savings Plans and select Role Assignment:
3. Select Add -> Role Assignment
4. Select “Savings Plan Reader" role and add the Quantum SPN as a member:
5. Click "Review + Assign" to grant the role to the Quantum application
If the option to add a new role assignment is disabled in the GUI, the following PowerShell script can be used instead:
Import-Module Az.Accounts
Import-Module Az.Resources
Connect-AzAccount -Tenant <TenantId>
New-AzRoleAssignment -Scope "/providers/Microsoft.BillingBenefits" -PrincipalId <ObjectId> -RoleDefinitionName "Savings plan Reader"
https://learn.microsoft.com/en-us/azure/cost-management-billing/savings-plan/permission-view-manage#assign-a-savings-plan-reader-role-at-the-tenant-level-by-using-azure-powershell-script