---
title: "Roles and permissions in Cost Analyzer"
slug: "roles-and-permissions-in-cost-analyzer"
updated: 2026-10-29T12:51:01Z
published: 2026-10-29T12:51:01Z
canonical: "docs.turbo360.com/roles-and-permissions-in-cost-analyzer"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions in Cost Analyzer

## Overview

Cost Analyzer uses role-based access control to manage who can view, configure, and manage different parts of the module. The first user who signs up for Turbo360 is assigned the **Account owner** role, with full access to the account. That user can add any number of users to Cost Analyzer and assign them system-defined or user-defined roles.

              
              

This article explains role management in Cost Analyzer. To view role management in other Turbo360 modules, see the articles below:

- [Roles and permissions in Business Applications](https://docs.turbo360.com/docs/roles-and-permissions-in-business-applications)
- [Roles and permissions in Business Activity Monitoring](https://docs.turbo360.com/docs/roles-and-permissions-in-bam)
- [Roles and permissions in Azure Documenter](https://docs.turbo360.com/docs/roles-and-permissions-in-azure-documenter)

### Business value

Fine-grained role management lets you restrict access to only what each user needs, reducing the risk of unauthorized changes and limiting exposure if an account is compromised.

## Prerequisites

### Required permissions

Role and user management access depends on the role type and, for custom roles, the Manage users permission setting.

| Role | Permission level | Access |
| --- | --- | --- |
| Account owner, Owner | - | Full access: create, edit, and delete roles; manage users |
| Contributor, Reader | - | No access to role or user management |
| Custom role | Manage users: Enabled | Add/remove users and assign existing roles; cannot create, edit, or delete roles |
| Custom role | Manage users: Disabled | No access to user or role management |

The permissions table above reflects what you see in Cost Analyzer under **Roles** > **Add role** > **Specify management permissions**.

## How it works

Cost Analyzer has three system-defined roles, and supports any number of user-defined roles.

- **Owner:** complete access to the module, including managing users and roles.
- **Contributor:** access to manage everything within the scope it's assigned to.
- **Reader:** access to read everything within the scope it's assigned to.

### Scope

The scope of a role determines the level in the module at which a user has the permissions specified for that role. Scope can be either:

1. Entire module
2. Cost management group

User and group role assignments for a Cost management group are managed from the **Users** option within that group.

              
              

Only users or groups with direct access to a Cost management group can be revoked access when viewed from the group's **Users** widget.

Each user in the **Users** list has a **Scope** column that shows whether access was assigned at the module level or directly to a specific Cost management group.

### Specify custom permissions

When adding a user, you can assign them a system-defined or user-defined role at a specific node level (a Cost management group) rather than across the entire module. This lets you grant precise access without giving the user visibility into unrelated groups.

The **Specify custom permissions** dialog lists all available Cost management groups. Each group can be individually enabled or disabled using the **Revoke / Grant access** toggle. A **Role** dropdown next to each entry lets you assign either a system-defined or user-defined role at that specific scope.

- You can assign different roles to different Cost management groups in a single operation, for example Contributor on a development group and Reader on a production group.
- Users with specified access cannot see groups they have not been explicitly granted.
- The role assigned at the group level applies only to that group and does not affect the user's access to other groups.

### User-defined roles

Account owners and module Owners can create any number of user-defined roles to specify permissions in the context of views and monitors, determining who can do what in a view or monitor.

A user-defined role contains the following sets of permissions:

1. **Account permissions:** the **Manage notification channels** permission, which lets users add, update, or remove notification channels.
2. **Management permissions:** permissions for administration tasks in the module, such as managing users, escalation policies, cost imports, and the chart library. The permissions are listed in the table below.
3. **Feature permissions:** a set of Cost Analyzer features. **Dashboard** has a **Read** / **Manage** switch: **Read** views the dashboard and its widgets, and **Manage** adds, edits, and deletes dashboard widgets. Features such as **Analysis**, **Reports**, and **Unit economics** have a row switch with **Read** and **Manage** checkboxes, so the role creator chooses read-only or manage access for each. **AI agents**, **Optimization**, and **Monitoring** are **Disable** / **Enable** switches. Setting **Monitoring** to **Enable** unlocks a separate set of monitoring tab permissions, and setting **Optimization** to **Enable** unlocks a separate set of optimization tab permissions. Both are described below.

The following table lists the account and management permissions available when you add a role.

| Permission | Section | Control | What it allows |
| --- | --- | --- | --- |
| Manage notification channels | Specify account permissions | On/off switch | Add, update, or remove notification channels. See [Managing notification channels](https://docs.turbo360.com/docs/managing-notification-channels). |
| Scope management | Specify management permissions | **Read** / **Manage** switch | **Read** views the scope configuration of a Cost management group. **Manage** edits the scope selection and uses bulk scope selection. See [Managing cost groups](https://docs.turbo360.com/docs/managing-cost-management-groups). |
| Group management | Specify management permissions | **Read** / **Manage** switch | **Read** views Cost management group details and the group overview. **Manage** creates, edits, moves, or deletes a Cost management group. See [Managing cost groups](https://docs.turbo360.com/docs/managing-cost-management-groups). |
| Manage escalation policy | Specify management permissions | On/off switch | Create, update, and delete escalation policies without broader ownership or contributor rights. See [Managing escalation policies](https://docs.turbo360.com/docs/managing-escalation-policies-in-cost-analyzer). |
| Manage cost imports | Specify management permissions | On/off switch | Manually trigger cost imports and manage import settings. See [Cost import health and management](https://docs.turbo360.com/docs/cost-import-health-and-management). |
| Manage chart library | Specify management permissions | On/off switch | Manage chart schemas in the chart library. See [Chart library](https://docs.turbo360.com/docs/chart-library). |
| Manage users | Specify management permissions | On/off switch | Add or remove users and assign existing roles. See Manage users permission scope below. |

The **Reader** system-defined role has **Read** only on **Group management**, **Scope management**, and **Dashboard**. A Reader can view group details, scope configuration, and dashboard widgets, but cannot create, edit, move, or delete groups, edit scope, or manage widgets.

For example, if a group of users needs to view the cost of certain subscriptions but shouldn't see the cost of others, you can create a role with access limited to a Cost Management Group containing only the required subscriptions, then assign that role to those users.

**Monitoring tab permissions:** under **Specify feature permissions**, the **Monitoring** feature is a **Disable** / **Enable** master switch for the **Monitoring** tab. A separate section, **Specify monitoring tab permissions**, gives each pane its own row switch with **Read** and **Manage** checkboxes. The **Budget planner** permission is part of this section.

| Permission | Read | Manage |
| --- | --- | --- |
| Group budget | View the group budget and its alerts | Configure the group budget and its alerts |
| Anomaly detection | View detected cost anomalies | Configure anomaly detection |
| Custom monitors | View all custom monitors | Add, edit, enable, disable, and delete custom monitors |
| Budget planner | View the budget planner | Configure budget planning |

The master switch and the per-tab rows work together as follows:

- Setting **Monitoring** to **Enable** grants **Read** on all four permissions. Setting it to **Disable** clears **Read** and **Manage** on all four.
- The row switch is what grants **Read**. The **Read** checkbox only shows the state of the row switch and cannot be changed by hand.
- Turning a row's switch on or off also clears that row's **Manage** checkbox.
- **Manage** can be selected only when **Monitoring** is **Enable** and the row's switch is on.
- **Monitoring** shows **Enable** when at least one row has **Read**, and **Disable** when none do.
- A new role starts with **Monitoring** set to **Disable** and all four rows off, so the **Monitoring** tab is hidden for that role until you grant access.

**What users see:** the **Monitoring** tab appears only when the user has **Read** on at least one of **Group budget**, **Anomaly detection**, **Custom monitors**, or **Budget planner**. Inside the tab, the user sees only the panes they can read, plus **Overview**, **Incidents**, and **Change history**. These three panes have no permission of their own and appear whenever at least one of the four permissions is readable. Where a user lacks **Manage**, configuration controls are hidden or disabled. Changing the status of an incident requires **Manage** on the source of that incident, **Group budget** or **Custom monitors**.

**System-defined roles:** system-defined roles cannot be edited and have the following monitoring tab permissions.

| Role | Group budget | Anomaly detection | Custom monitors | Budget planner |
| --- | --- | --- | --- | --- |
| Account owner | Full access | Full access | Full access | Full access |
| Owner | Read, Manage | Read, Manage | Read, Manage | Read, Manage |
| Contributor | Read, Manage | Read, Manage | Read, Manage | Read, Manage |
| Reader | Read | Read | Read | Read |

**Optimization tab permissions:** under **Specify feature permissions**, the **Optimization** feature is a **Disable** / **Enable** master switch for the **Optimization** tab. A separate section, **Specify optimization tab permissions**, lists each Optimization area. Each area has its own row switch with **Read** and **Manage** checkboxes, except **Manage advanced recommendations**, which is a single on/off switch. The **Optimization** switch must be set to **Enable** before the row permissions take effect. To give a role access to an area, turn on its row switch and select **Read** and/or **Manage**.

| Permission | Read | Manage |
| --- | --- | --- |
| Schedules | View optimization schedules and the Impact tracker | Edit, enable, disable, and run schedules; full access to the Impact tracker |
| Workflows | View workflows | Create, update, delete, and run workflows |
| Rightsizing | View Basic and Advanced recommendations | Take actions on Basic and Advanced recommendations |
| Reservations | View recommendations | Postpone and dismiss recommendations |
| Savings plans | View recommendations | Take actions on recommendations |
| Hybrid benefits | View Hybrid benefits | Ignore potential resources and use the ignore-related actions |
| Spot instances | View and export Spot instances data | Full access to Spot instances, including export |
| Other recommendations | View recommendation types, affected resources, and consolidated savings | Trigger notifications, ignore or restore resources, and export recommendation data |

**Manage advanced recommendations** is a single on/off switch with no **Read** or **Manage** checkboxes. It lets the user manage advanced recommendations, such as turning them on for a Cost management group in **Recommendation settings**.

There is no dedicated Impact tracker permission. Impact tracker access follows the **Schedules** permission. **Upgrades and retirements** uses the **Other recommendations** permission.

**System-defined roles:** system-defined roles cannot be edited and have the following optimization tab permissions.

| Role | Access to Optimization areas |
| --- | --- |
| Account owner | Full access |
| Owner | Read, Manage |
| Contributor | Read, Manage |
| Reader | Read |

### Manage users permission scope

The **Manage users** permission controls user assignment, not role definition. A user or role with this permission can:

- Add or remove users from the module or a Cost management group
- Assign existing roles (system-defined or user-defined) to users

It does not allow the user to:

- Create a new role
- Edit an existing role's permissions
- Delete a role

The **Roles** tab reflects this: a user with only the Manage users permission sees the roles list, but the **Actions** column shows no available options against any role. Creating, editing, and deleting roles is reserved for **Account owner** and module **Owner**.

## Steps

Use the following steps to add, delete, and export role and permission data in Cost Analyzer. Start from the **Roles** tab within the module.

### Add a role

Adding a role lets you define a reusable, named set of feature and management permissions to assign to users.

1. Go to the **Roles** tab.
2. Select **Add role**.
3. Enter a name and an optional description.
4. Configure the account, management, and feature permissions for the role.
5. To give the role access to the **Monitoring** tab, set **Monitoring** to **Enable** under **Specify feature permissions**.
6. Under **Specify monitoring tab permissions**, turn on the row switch for each pane the role can view, which sets **Read**, and select **Manage** on the panes the role can configure.
7. To give the role access to the **Optimization** tab, set **Optimization** to **Enable** under **Specify feature permissions**.
8. Under **Specify optimization tab permissions**, turn on the row switch for each area the role needs, then select **Read** and/or **Manage**.
9. Select **Save**.

To change an existing role, open it in **Edit role**. The same row switch and **Manage** behavior applies. The button is **Update** instead of **Save**. When you select **Update**, the **Update role** confirmation asks `Are you sure you want to update the role '<name>' ?`. Confirm the prompt to apply the changes.

### Delete a role

Deleting a role removes it from the module while preserving access for the users it was assigned to, by transferring them to a replacement role.

1. Go to the **Roles** tab.
2. Click the **Actions menu** next to the role to delete.
3. Select **Delete role**.
4. Review or change the pre-selected replacement role, then confirm the deletion.

### Export user permissions

Exporting user details gives you an offline record of exactly which permissions each user holds at every level of the account.

1. Go to the **Roles** tab.
2. Select the export option to download user details and permissions as a CSV file.

## Permission behavior

User-defined roles govern permissions in the context of a view, monitor, or optimization schedule. Deleting a view or optimization schedule, or managing service principals in the module, requires at least a **Contributor** role; a user-defined role alone is not sufficient for these operations.

Monitoring operations follow the permissions under **Specify monitoring tab permissions**. A user-defined role with **Manage** on **Custom monitors** can add, edit, enable, disable, and delete custom monitors.

Optimization operations follow the permissions under **Specify optimization tab permissions**. A user-defined role with **Manage** on **Workflows** can create, update, delete, and run workflows.

A request made without the required permission is rejected with the message `You are not authorized to perform this action. Please contact your Administrator. User: <email> Action: <action> Permission: <permission>`.

## Example scenario

A team lead manages views, monitors, and optimization schedules for both testing and production. They can be assigned a **Contributor** role scoped to testing views, monitors, and schedules, with a separate, more restricted role for production ones using Specify custom permissions. A user who manages the entire module but shouldn't manage users or roles can instead be assigned a **Contributor** role across the whole module.

## Troubleshooting

1. **Add role, edit, or delete options is greyed out** Cause: Only Account owner and Owner can create, edit, or delete roles. The Manage users permission lets a role manage user assignments but not role definitions; this shows up as an empty Actions column on the Roles tab. Fix: Ask an Account owner or the module Owner to create, edit, or delete the role on your behalf, or to grant you the Owner role if you need this capability regularly.
2. **Unsure who inherits access after deleting a role** Cause: The delete confirmation always pre-selects a default replacement role (e.g. Contributor) to reassign any users currently holding the deleted role. Fix: Review the replacement role in the confirmation dialog and change it if Contributor isn't the intended fallback, before selecting Delete.
3. **A user has unexpected access to a Cost management group** Cause: The user was directly assigned a role scoped to that specific group, in addition to or instead of a module-wide role. Fix: Open the group's **Users** widget and check the **Scope** column to see whether access comes from a direct group-level assignment, then adjust or revoke it there.
4. **The Monitoring tab is missing for a user** Cause: The user's role does not have **Read** on any of **Group budget**, **Anomaly detection**, **Custom monitors**, or **Budget planner** for that Cost management group. Fix: Edit the role and turn on the row switch for at least one row under **Specify monitoring tab permissions**, which sets **Read**, or assign a role that has it on that group.
5. **The Manage checkbox cannot be selected in the role editor** Cause: **Manage** is disabled while **Monitoring** is set to **Disable** or the row's switch is off. Fix: Set **Monitoring** to **Enable**, turn on the row switch, and then select **Manage**.
6. **An Optimization area is missing or read-only for a user** Cause: The user's role has **Optimization** set to **Disable**, the area's row under **Specify optimization tab permissions** is off, or the role has **Read** but not **Manage** on that area. Fix: Edit the role, set **Optimization** to **Enable**, turn on the row switch for the area, and select **Manage** if the user needs to take actions.

## FAQs

1. **Can a user have different roles in different Cost management groups?** Yes. Roles are assigned per scope. You can assign a user Contributor on one group and a read-only user-defined role on another using Specify custom permissions, within the same module.
2. **What happens to users when a role is deleted?** You must select a replacement role before the deletion completes. All users assigned the deleted role are automatically reassigned to the replacement role. No user loses access to Cost Analyzer.
3. **Can a user-defined role restrict access to specific Cost management groups?** Yes. When assigning a role to a user, use Specify custom permissions and select the Cost management groups the user should be able to see. Users with specified access cannot see groups they have not been explicitly granted.

## Related articles

- [Cost Analyzer quick start](https://docs.turbo360.com/docs/cost-analyzer-quick-start-1)
- [Managing users with email authentication](https://docs.turbo360.com/docs/managing-users-with-email-authentication-in-cost-analyzer)
- [Managing users with Microsoft Entra ID](https://docs.turbo360.com/docs/managing-users-with-microsoft-entra-id-in-cost-analyzer)
- [Roles and permissions in Business Applications](https://docs.turbo360.com/docs/roles-and-permissions-in-business-applications)
- [Roles and permissions in Business Activity Monitoring](https://docs.turbo360.com/docs/roles-and-permissions-in-bam)
- [Roles and permissions in Azure Documenter](https://docs.turbo360.com/docs/roles-and-permissions-in-azure-documenter)