August 2026 release is live Read More
Breadcrumbs

Azure CSP onboarding Root Tenant as Billing

There are following two ways to onboard Azure CSP using a Root Tenant as the billing scope.

Why this matters: a CSP relationship is managed by a partner through a Root Tenant / Management Group, not a standard billing account ID — so the app registration and role assignments here happen at that management-group scope rather than at a single subscription.

Steps to onboard through CLI

To manage a Microsoft Entra ID app and create a client secret, the Microsoft Entra ID Application Administrator role is required

Create Microsoft Entra ID app 

az ad sp create-for-rbac --display-name "<APP_NAME>" --years=2 -o table

  • <APP_NAME>: Enter the unique name. Recommended (mavvrik_management_group)

  • Capture App id, Password and Tenant id which will be used in subsequent steps

To assign permissions to the Microsoft Entra ID app, it is recommended to have the Owner role. Alternatively, you can have both the Contributor and User Access Administrator roles.

Assign Permissions to the App (Mandatory) 

az role assignment create --assignee "<APP_ID>" --role "Reader" --scope "/providers/Microsoft.Management/managementGroups/<MANAGEMENT_GROUP-ID>" -o table

  • <APP_ID> : Enter App id created in above step

  • <MANAGEMENT_GROUP-ID>: Enter your Root Tenant Id(To Get Root Tenant id Navigate to Azure Console > Search Root Tenant > Capture the id)

Assign Additional Permissions to the App (Mandatory for Tier2 Customers) 

az role assignment create --assignee "<APP_ID>" --role "Reservations Reader" --scope "/providers/Microsoft.Capacity" -o table

az role assignment create --assignee "<APP_ID>" --role "Savings Plan Reader" --scope "/providers/Microsoft.BillingBenefits" -o table

  • <APP_ID> : Enter App id created in above step

Connect Billing Account

  1. Login to Mavvrik

  2. Go to Menu > Admin > Public Clouds

  3. Click on +Account

  4. Select CSP as Account type and Billing Scope as Root Tenant

  5. Enter required details

  6. Click Connect

You can use the same credentials to onboard the Root Tenant as a usage account. Azure CSP Root Tenant Manual CLI Onboarding

Steps to onboard through UI

1) Create the Microsoft Entra ID app

A. Register the app

  1. Sign in to Azure Portal

  2. Go to Microsoft Entra ID

Azure App registrations page
Azure App registrations page

  1. Select App registrations → + New registration

  2. Fill:

    • Name: mavvrik_management_group (or your preferred unique name)

    • Supported account types: choose Accounts in this organizational directory only (recommended for CSP tenant)

    • Redirect URI: leave blank (not required)

  3. Click Register

B. Capture required IDs

After registration, go to the app's Overview page and copy:

  • Application (client) ID ✅ (this is your APP_ID)

  • Directory (tenant) ID ✅

C. Create the client secret

  1. Inside the same app, go to Certificates & secrets

  2. Under Client secrets, click + New client secret

  3. Fill:

    • Description: mavvrik_secret

    • Expires: choose 24 months / 2 years (match your CLI --years=2)

  4. Click Add

  5. Immediately copy the Value (NOT the Secret ID)

    • This copied Value is your Client Secret ✅

    • You won't be able to view it again later.

2) Assign Permissions to the App at the Root Tenant (Mandatory)

A. Get your Root Tenant ID

  1. In Azure Portal search: Management groups

  2. Select the Root Tenant you want

  3. Copy the Management Group ID (not the display name)

Root tenant management group ID
Root tenant management group ID

B. Assign "Reader" role on the Root Tenant

  1. Open Management groups

  2. Click the Tenant root Management Group

  3. Go to Access control (IAM)

  4. Click + Add → Add role assignment

Add a role assignment from management group IAM
Add a role assignment from management group IAM

  1. In Role: select Reader

Select the Reader role
Select the Reader role

  1. In Members:

    • Click Select members

    • Search your app name (example: mavvrik_management_group)

Select the application as a role assignment member
Select the application as a role assignment member

  1. Select it (continued from above)

  2. Click Review + assign → Assign

3) Assign Additional Permissions to the App (Mandatory for Tier2 Customers)

  1. In Azure Portal search: Reservations and open it.

  2. Click on Role Assignment

Reservation role assignments page
Reservation role assignments page

  1. Click + Add → Add role assignment

  2. Under Role, select Reservations Reader.

Select the Reservations Reader role and application
Select the Reservations Reader role and application

  1. Click Next

  2. Click Select members

    • Search your app name (example: mavvrik_management_group)

    • Select it

  3. Click Review + assign → Assign

  4. In Azure Portal search: Savings plans and open it.

  5. Click on Role Assignment

Savings plan role assignments page
Savings plan role assignments page

  1. Click + Add → Add role assignment

  2. Under Role, select Savings Plan Reader.

Select the Savings Plan Reader role and application
Select the Savings Plan Reader role and application

  1. Click Next

  2. Click Select members

    • Search your app name (example: mavvrik_management_group)

    • Select it

  3. Click Review + assign → Assign

Troubleshooting

The Root Tenant billing account does not connect

  1. Confirm that the application Client ID, Directory (tenant) ID, and client secret value come from the same Microsoft Entra ID application. Use the secret Value, not the Secret ID.

  2. Check that the Root Tenant identifier is the Management Group ID, not its display name.

  3. Verify that Reader is assigned to that application at the intended root management-group scope.

  4. In Mavvrik, confirm that Account type is CSP and Billing Scope is Root Tenant before checking the entered connection details.

Tier2 reservation or Savings Plan information is missing

  1. Check the additional role assignments documented for Tier2 customers, not only the Reader assignment on the management group.

  2. Verify that the same application has Reservations Reader at /providers/Microsoft.Capacity and Savings Plan Reader at /providers/Microsoft.BillingBenefits.

  3. If an assignment is missing, ask an authorized administrator to complete the corresponding permission step in this guide.