Set "Reader" permissions for an Azure Subscription
Step 1: Add a new contract to Azure Costs
This article presumes that you are currently in the process of registering a new contract for Azure Costs. A getting starting guide how to do this is available here. You should now see your Azure subscriptions and an exclamation mark because the read-only permissions are not set yet.
Step 2: Click "Set Permissions"
Please repeat this step for every subscription you see the exclamation mark. Ensure that you are logged in successfully in the Azure Portal and click the Set Permissions link:
The system should switch in a different browser tab and you should see the role assignment dialog in the Azure Portal which looks like this:
Step 3: Add "Reader" permission to "Azure Cost Analytics" application
Select the "Add" action to start the assignment process. The system should show you a couple roles. Please choose the "Reader" role which gives Azure Costs read-only permissions to the spending information of your subscription:
In the next step you need to select the role and the user who should become part of the role. With "user" Azure means the Azure Costs application which is not shown automatically. Please search in the text-box for "Azure Costs Analytics" and select this user. It's important to select the right application because Azure Costs offers different Azure Active Directory integrations. The right application is called "Azure Costs Analytics".
Finally it should look like the image bellow. Whenever you would like to remove permissions of the Azure Costs service for one or more subscriptions, you can just remove the role assignment in this dialog as well.
