Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Access management and control is a critical function for any organization using the cloud. Azure's role-based access control (RBAC) is a security approach to control access based on roles assigned to people within an organization, providing a layer of security for your Azure environment. Assigning the correct roles and permissions to people within the organization is a foundational step for transacting through Microsoft Marketplace and ensuring a streamlined purchase experience.
Roles and permissions
Microsoft Marketplace centralizes your cloud investments from Microsoft and our extended network of partners. It uses Azure Role-Based Controls (RBAC) to enable you to acquire solutions certified to run on Azure. These role-based controls delineate purchasing privileges within your organization, ensuring adherence to compliance standards, established security protocols, and workflows by restricting purchases to authorized personnel.
Assigning roles and permissions to people within the organization is a foundational step to guaranteeing secure and compliant access to Microsoft Marketplace transactions and contributes to the secure utilization of Microsoft Marketplace as a cloud solution procurement platform.
The following table summarizes the roles required to purchase a public offer, a private offer, or a private plan. For private offers, permission considerations to accept the offer and then purchase the offer vary depending on your organization's commercial agreement with Microsoft.
The private-offer rows in this table describe the separate acceptance and purchase experience. For single-click purchase, see the additional account requirements.
| Commercial agreement | Offer | Role required to accept | Role required to purchase or subscribe |
|---|---|---|---|
| Microsoft Customer Agreement (MCA) | Public offer | n/a | Subscription owner or contributor |
| Private plan | n/a | Subscription owner or contributor | |
| Private offer | Billing account owner or contributor (primary tenant) | VM software reservations offer type: Subscription owner or reservation purchaser. All other offer types: Subscription owner or contributor | |
| Enterprise Agreement (EA) | Public offer | n/a | Subscription owner or contributor |
| Private plan | n/a | Subscription owner or contributor | |
| Private offer | Enterprise administrator | VM software reservation offer type: Subscription owner or reservation purchaser. All other offer types: Subscription owner or contributor |
Purchase-time access and ongoing resource-management access are different. Completing a single-click purchase doesn't necessarily grant permission to manage, move, or cancel the resulting resources. Contact your administrator if you need more access.
Check permissions to purchase a private offer or a private plan
Important
Private offers that use separate acceptance and purchase require acceptance before purchasing. These steps can require different permissions and can be performed by different people.
Eligible private offers that use single-click purchase combine acceptance and purchase submission. Review the single-click purchase requirements before starting; the combined experience doesn't remove authorization or organizational approval requirements.
When purchasing a private offer or private plan, perform a pre-check on your account to verify permissions and account settings that might block the purchase.
Check permissions to purchase a public offer
A public offer is a solution available for purchase in Microsoft Marketplace with publicly listed pricing and terms. Follow these steps to check the assigned permissions to purchase a public offer:
Log into the Azure portal at https://un5gmtkzgjctf758hkx05qg8k0.subtlesoundimmersion.net using your credentials.
Select the Account profile icon on the top right corner of the screen:
Select the ellipsis (...).
Select My permissions. A list of all assigned permissions displays for the selected subscription.
Find subscription owners who can grant permissions
If you don't have the correct role and permissions, you can follow these steps to find people in your organization with role assignments, including subscription owners who can grant access to the subscription:
Select Go to subscription access control to view information on levels of access to the subscription and view all individuals in your organization with role assignments, including subscription owners and subscription contributors:
Select View access to this resource to view roles assigned to individuals within your organization:
A list of individuals with all role assignments, including subscription owners and subscription contributors displays:
Single-click purchase: authority by task
Single-click purchase combines the customer actions, not the underlying permission scopes. Check authority to accept the offer, use an existing subscription, create a subscription, and manage the purchased resource separately. The existing separate acceptance and purchase workflow remains unchanged.
| Task | Authority to check | Important boundary |
|---|---|---|
| Complete single-click purchase with an MCA account | Billing Account Owner or Billing Account Contributor on the private offer's billing account. | Billing Profile Owner or Contributor alone is insufficient. Subscription-creation permissions don't replace this purchasing requirement. |
| Use an existing Azure subscription | Purchase and resource access on an eligible subscription associated with the offer's billing account and the correct directory. | Billing access and Azure resource access are separate. Supported purchase-time access doesn't automatically grant ongoing resource-management rights. |
| Create an MCA Azure subscription | Owner or Contributor on the applicable billing account, billing profile, or invoice section, or Azure subscription creator on the invoice section. | These are Azure subscription-creation permissions, not a complete list of single-click purchase permissions. See Create an MCA subscription. |
| Create an EA Azure subscription during single-click purchase | Enterprise Administrator or Enrollment Account Owner. | Either role is supported; the purchaser doesn't need both. Subscription creation remains subject to the applicable enrollment account and directory requirements. See Create an EA subscription. |
| Complete single-click purchase with Legacy Web Direct/MOSP | Billing Account Owner or Billing Account Contributor on the MCA billing account associated with the LWD account, together with the required access to an existing eligible subscription. | Single-click checkout doesn't create an Azure subscription or provide purchase-time elevation for this account type. |
| Manage the purchased resource | The Azure permissions required for the management action. | Purchase-time access doesn't automatically assign Azure Owner or provide ongoing management access. |
Use the least access required for the task. Purchase-time access doesn't bypass Azure Policy, Marketplace purchasing controls, or deny assignments. Ask your administrator to arrange ongoing access for the people who manage the resource after purchase.