Roles and permissions in Cost Analyzer

Overview

Cost Analyzer uses role-based access control to manage who can view, configure, and manage different parts of the module. The first user who signs up for Turbo360 is assigned the Account Owner role, with full access to the account. That user can add any number of users to Cost Analyzer and assign them system-defined or user-defined roles.

This article explains role management in Cost Analyzer. To view role management in other Turbo360 modules, see the articles below:

Business value

Fine-grained role management lets you restrict access to only what each user needs, reducing the risk of unauthorized changes and limiting exposure if an account is compromised.

Prerequisites

Required permissions

Role and user management access depends on the role type and, for custom roles, the Manage users permission setting.

Role	Permission level	Access
Account Owner, Owner	—	Full access: create, edit, and delete roles; manage users
Contributor, Reader	—	No access to role or user management
Custom role	Manage users: Enabled	Add/remove users and assign existing roles; cannot create, edit, or delete roles
Custom role	Manage users: Disabled	No access to user or role management

The permissions table above reflects what you see in Cost Analyzer under Roles > Add role > Specify management permissions.

How it works

Cost Analyzer has three system-defined roles, and supports any number of user-defined roles.

Owner — complete access to the module, including managing users and roles.
Contributor — access to manage everything within the scope it's assigned to.
Reader — access to read everything within the scope it's assigned to.

Scope

The scope of a role determines the level in the module at which a user has the permissions specified for that role. Scope can be either:

Entire module
Cost management group

User and group role assignments for a Cost management group are managed from the Users option within that group.

Only users or groups with direct access to a Cost management group can be revoked access when viewed from the group's Users widget.

Each user in the Users list has a Scope column that shows whether access was assigned at the module level or directly to a specific Cost management group.

Specify custom permissions

When adding a user, you can assign them a system-defined or user-defined role at a specific node level — a Cost management group — rather than across the entire module. This lets you grant precise access without giving the user visibility into unrelated groups.

The Specify custom permissions dialog lists all available Cost management groups. Each group can be individually enabled or disabled using the Revoke / Grant access toggle. A Role dropdown next to each entry lets you assign either a system-defined or user-defined role at that specific scope.

You can assign different roles to different Cost management groups in a single operation — for example, Contributor on a development group and Reader on a production group.
Users with specified access cannot see groups they have not been explicitly granted.
The role assigned at the group level applies only to that group and does not affect the user's access to other groups.

User-defined roles

Account Owners and module Owners can create any number of user-defined roles to specify permissions in the context of views and monitors — determining who can do what in a view or monitor.

A user-defined role contains two sets of permissions:

Management permissions — the user management permission that lets users manage other users and their permissions. The role creator chooses read-only or manage access for this permission.
Feature permissions — a set of Cost Analyzer features, each with read-only or manage access chosen by the role creator.

For example, if a group of users needs to view the cost of certain subscriptions but shouldn't see the cost of others, you can create a role with access limited to a Cost Management Group containing only the required subscriptions, then assign that role to those users.

Manage users permission scope

The Manage users permission controls user assignment, not role definition. A user or role with this permission can:

Add or remove users from the module or a Cost management group
Assign existing roles — system-defined or user-defined — to users

It does not allow the user to:

Create a new role
Edit an existing role's permissions
Delete a role

The Roles tab reflects this: a user with only the Manage users permission sees the roles list, but the Actions column shows no available options against any role. Creating, editing, and deleting roles is reserved for Account Owner and module Owner.

Steps

Use the following steps to add, delete, and export role and permission data in Cost Analyzer. Start from the Roles tab within the module.

Add a role

Adding a role lets you define a reusable, named set of feature and management permissions to assign to users.

Go to the Roles tab.
Select Add role.
Enter a name and an optional description.
Configure the feature permissions for the role.

Delete a role

Deleting a role removes it from the module while preserving access for the users it was assigned to, by transferring them to a replacement role.

Go to the Roles tab.
Click the Actions menu next to the role to delete.
Select Delete role.
Review or change the pre-selected replacement role, then confirm the deletion.

Export user permissions

Exporting user details gives you an offline record of exactly which permissions each user holds at every level of the account.

Go to the Roles tab.
Select the export option to download user details and permissions as a CSV file.

Permission behavior

User-defined roles govern permissions in the context of a view, monitor, or optimization schedule. Deleting a view, monitor, or optimization schedule, or managing service principals in the module, requires at least a Contributor role — a user-defined role alone is not sufficient for these operations.

Example scenario

A team lead manages views, monitors, and optimization schedules for both testing and production. They can be assigned a Contributor role scoped to testing views, monitors, and schedules, with a separate, more restricted role for production ones using Specify custom permissions. A user who manages the entire module but shouldn't manage users or roles can instead be assigned a Contributor role across the whole module.

Troubleshooting

Add role, edit, or delete options is greyed out
Cause: Only Account Owner and Owner can create, edit, or delete roles. The Manage users permission lets a role manage user assignments but not role definitions — this shows up as an empty Actions column on the Roles tab.
Fix: Ask an Account Owner or the module Owner to create, edit, or delete the role on your behalf, or to grant you the Owner role if you need this capability regularly.
Unsure who inherits access after deleting a role
Cause: The delete confirmation always pre-selects a default replacement role (e.g. Contributor) to reassign any users currently holding the deleted role.
Fix: Review the replacement role in the confirmation dialog and change it if Contributor isn't the intended fallback, before selecting Delete.
A user has unexpected access to a Cost management group
Cause: The user was directly assigned a role scoped to that specific group, in addition to or instead of a module-wide role.
Fix: Open the group's Users widget and check the Scope column to see whether access comes from a direct group-level assignment, then adjust or revoke it there.

FAQs

Can a user have different roles in different Cost management groups?
Yes. Roles are assigned per scope. You can assign a user Contributor on one group and a read-only user-defined role on another using Specify custom permissions, within the same module.
What happens to users when a role is deleted?
You must select a replacement role before the deletion completes. All users assigned the deleted role are automatically reassigned to the replacement role. No user loses access to Cost Analyzer.
Can a user-defined role restrict access to specific Cost management groups?
Yes. When assigning a role to a user, use Specify custom permissions and select the Cost management groups the user should be able to see. Users with specified access cannot see groups they have not been explicitly granted.