Breadcrumbs

Azure CSP onboarding Root Tenant as Billing

There are following two ways to onboard Azure CSP using a Root Tenant as the billing scope.

Steps to onboard through CLI

To manage an Azure Active Directory (AAD) app and create a client secret, the Active Directory administrator role is required

Create AAD 

az ad sp create-for-rbac --display-name "<APP_NAME>" --years=2 -o table


  • <APP_NAME>: Enter the unique name. Recommended (mavvrik_management_group)

  • Capture App id, Password and Tenant id which will be used in subsequent steps

To assign permissions to the Azure Active Directory (AAD) app, it is recommended to have the Owner role. Alternatively, you can have both the Contributor and User Access Administrator roles.

Assign Permissions to the App (Mandatory) 

az role assignment create --assignee "<APP_ID>" --role "Reader" --scope "/providers/Microsoft.Management/managementGroups/<MANAGEMENT_GROUP-ID>" -o table

  • <APP_ID> : Enter App id created in above step

  • <MANAGEMENT_GROUP-ID>: Enter your Root Tenant Id(To Get Root Tenant id Navigate to Azure Console > Search Root Tenant > Capture the id)

Assign Additional Permissions to the App (Mandatory for Tier2 Customers) 

az role assignment create --assignee "<APP_ID>" --role "Reservations Reader" --scope "/providers/Microsoft.Capacity" -o table

az role assignment create --assignee "<APP_ID>" --role "Savings Plan Reader" --scope "/providers/Microsoft.BillingBenefits" -o table

  • <APP_ID> : Enter App id created in above step

Connect Billing Account

  1. Login to Mavvrik

  2. Go to Menu > Admin > Public Clouds

  3. Click on +Account

  4. Select CSP as Account type and Billing Scope as Root Tenant

  5. Enter required details

  6. Click Connect

You can use the same credentials to onboard the Root Tenant as a usage account. Azure CSP Root Tenant Manual CLI Onboarding

Steps to onboard through UI

1) Create the Azure AD App

A. Register the app

  1. Sign in to Azure Portal

  2. Go to Microsoft Entra ID (Azure AD)

    image-20260216-102109.png

  3. Select App registrations → + New registration

  4. Fill:

    • Name: mavvrik_management_group (or your preferred unique name)

    • Supported account types: choose Accounts in this organizational directory only (recommended for CSP tenant)

    • Redirect URI: leave blank (not required)

  5. Click Register

B. Capture required IDs

After registration, go to the app’s Overview page and copy:

  • Application (client) ID ✅ (this is your APP_ID)

  • Directory (tenant) ID ✅

C. Create the client secret

  1. Inside the same app, go to Certificates & secrets

  2. Under Client secrets, click + New client secret

  3. Fill:

    • Description: mavvrik_secret

    • Expires: choose 24 months / 2 years (match your CLI --years=2)

  4. Click Add

  5. Immediately copy the Value (NOT the Secret ID)

    • This copied Value is your Client Secret ✅

    • You won’t be able to view it again later.

2) Assign Permissions to the App at the Root Tenant (Mandatory)

A. Get your Root Tenant ID

  1. In Azure Portal search: Management groups

  2. Select the Root Tenant you want

  3. Copy the Management Group ID (not the display name)

    image-20260216-102406.png

B. Assign “Reader” role on the Root Tenant

  1. Open Management groups

  2. Click the Tenant root Management Group

  3. Go to Access control (IAM)

  4. Click + Add → Add role assignment

    image-20260216-102540.png

  5. In Role: select Reader

    image-20260216-102457.png

  6. In Members:

    • Click Select members

    • Search your app name (example: mavvrik_management_group)

      image-20260216-102715.png

    • Select it

  7. Click Review + assign → Assign

3) Assign Additional Permissions to the App (Mandatory for Tier2 Customers)

  1. In Azure Portal search: Reservations and open it.

  2. Click on Role Assignment

    image-20260216-101232.png

  3. Click + Add → Add role assignment

  4. Under Role, select Reservations Reader.

    image-20260216-101418.png

  5. Click Next

  6. Click Select members

    • Search your app name (example: mavvrik_management_group)

    • Select it

  7. Click Review + assign → Assign

  8. In Azure Portal search: Savings plans and open it.

  9. Click on Role Assignment

image-20260216-101730.png

  1. Click + Add → Add role assignment

  2. Under Role, select Savings Plan Reader.

image-20260216-101819.png

  1. Click Next

  2. Click Select members

    • Search your app name (example: mavvrik_management_group)

    • Select it

  3. Click Review + assign → Assign