Need Help with Bicep and ARM template

Piyush Solanki 0 Reputation points
2026-10-03T19:21:05.2766667+00:00

I am working for a tool to make , which using bicep can find out service principal id and app id and assign these roles at the following scopes :

  1. Reader at tenant root group
  2. Cost Management reader at tenant root group
  3. Reservations Reader from Home -> Reservations reader
  4. Savings Plan Reader from Home -> SavingPlans reader

But the last two are not able to be targeted from bicep and i am having errors .
Also I would want to run exports for historical backfill for the last 3 months say if this is october , then sept , august, july.
and in that bicep i would create storage account and put that data there. How can i call the last two readers from bicep and run export as well from bicep. If I have elevated access and Global Administrator and Owner at '/' scope using cli . I also need to assing Owner at '/' from portal is that possible. Its urgent help

Azure Role-based access control
Azure Role-based access control

An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Salamat Shah 750 Reputation points MVP
    2026-10-04T06:59:30.4+00:00

    This needs to be split because the four permissions don't all live at the same Azure RBAC scope.

    Reader + Cost Management Reader at tenant-root management group

    These can be deployed through Bicep using Microsoft. Authorization/role Assignments at management-group scope. Bicep supports RBAC role assignments at different scopes.

    Reservations Reader / Savings Plan Reader

    Don't treat Home → Reservations/Savings Plans as normal management-group resources. Their scopes/resource providers differ from conventional subscription/management-group RBAC, so trying to assign them from the same root-MG Bicep deployment can fail. Reservations, for example, use the Microsoft. Capacity/reservation Orders resource hierarchy.

    Recommended: handle these role assignments separately using the appropriate REST/CLI/API scope, or a Bicep deployment script if you need one automated deployment workflow.

    Cost export + previous 3 months

    Bicep can create the storage account and Microsoft.CostManagement/exports resource, including a custom time Period.

    However, think of Bicep as creating/configuring the export. For historical backfill, use the Cost Management export run/rerun operation after deployment. Microsoft specifically supports selectively rerunning exports for historical periods.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.