Use this script to grant Turbo360 the permissions it needs to read Azure commitment data, including reservations and savings plans.
Prerequisites
Azure CLI is installed.
PowerShell is installed.
You have the client ID of the app registration you set up for Turbo360.
Steps
Save the script from the Script section below to a file named
Setup-Commitments-Permissions.ps1.Sign in to the Azure CLI twice — once for the Azure Resource Management scope and once for the Microsoft Graph scope — using the following commands.
az login --use-device-code --tenant [Your tenant id] --scope https://management.core.windows.net//.default
az login --use-device-code --tenant [Your tenant id] --scope https://graph.microsoft.com//.default
Run the script using the following command.
.\Setup-Commitments-Permissions.ps1 -ClientId "[Your client id]"Script
The script looks up the service principal by client ID, then assigns the Reservations Reader role at the /providers/Microsoft.Capacity scope and the Savings plan Reader role at the /providers/Microsoft.BillingBenefits scope. It verifies all assignments on completion.
param(
[Parameter(Mandatory = $true)]
[string]$ClientId
)
# Look up the Service Principal Object ID from the App Registration Client ID
Write-Host "Looking up Service Principal for Client ID: $ClientId ..."
$SpObjectId = az ad sp show --id $ClientId --query id -o tsv
if (-not $SpObjectId) {
Write-Error "Could not find a Service Principal for Client ID '$ClientId'. Ensure the App Registration exists and you are logged in to the correct tenant."
exit 1
}
Write-Host "Found Service Principal Object ID: $SpObjectId"
# Role assignments to create
$Assignments = @(
@{ Role = "Reservations Reader"; Scope = "/providers/Microsoft.Capacity" },
@{ Role = "Savings plan Reader"; Scope = "/providers/Microsoft.BillingBenefits" }
)
foreach ($Assignment in $Assignments) {
Write-Host "`nAssigning '$($Assignment.Role)' at scope '$($Assignment.Scope)' ..."
az role assignment create --assignee-object-id "$SpObjectId" --assignee-principal-type ServicePrincipal --role "$($Assignment.Role)" --scope "$($Assignment.Scope)"
if ($LASTEXITCODE -ne 0) {
Write-Warning "Failed to assign '$($Assignment.Role)'. Check the error above."
} else {
Write-Host "Successfully assigned '$($Assignment.Role)'."
}
}
Write-Host "`nVerifying assignments ..."
az role assignment list --assignee "$SpObjectId" --output table