--- title: Billing access for EA customers canonical: "https://cloudmonitor.ai/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers/" description: "Follow these steps to allow CloudMonitor to access, and view Billing Information for Enterprise Agreement (EA) customers." --- Follow these steps to allow CloudMonitor to access, and view Billing Information for Enterprise Agreement (EA) customers. :::tip These instructions show how to grant the read-only EnrollmentReader role to the CloudMonitor Service Principal for customers that have Legacy Enterprise Agreements (EA) with Microsoft. Only Department Administrators and Account Owners are allowed to assign the EnrollmentReader Role to the CloudMonitor Service Principal. If you do not have any of these 2 roles ask your Enterprise Administrator to [assign these roles to you](https://cloudmonitor.ai/docs/how-to-articles/how-assign-roles-as-an-enterprise-administrator-enterprise-agreement-customers/). ::: :::tip The following steps will utilize the Azure REST API to grant the read-only EnrollmentReader role to a Service Principal. Microsoft has confirmed that this is a known limitation of the Azure Portal and provided this alternative method. Customers on MCA agreements do not need to do this step. ::: ### Step 1 First navigate to the REST API page - [https://learn.microsoft.com/en-us/rest/api/billing/2019-10-01-preview/role-assignments/put?tabs=HTTP#code-try-0](https://learn.microsoft.com/en-us/rest/api/billing/2019-10-01-preview/role-assignments/put?tabs=HTTP#code-try-0) • Sign in with an Admin Account. • Select the AD Tenant that contains the CloudMonitor Service Principal. ![First navigate to the REST API page -…](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-01.jpeg) ### Step 2 You will see that the right pane has changed into a simple API platform. In the Parameters section we need to provide values for the following fields: 1. billingAccoutName 2. billingRoleAssignmentName ![billingAccoutName 2. billingRoleAssignmentName](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-02.jpeg) ### Step 3 The billingAccountName is your "Billing account ID". You can find this in the Azure portal on the "Cost Management + Billing" Overview. In our example below it is 1111111. ![The billingAccountName is your "Billing account ID". You can find this in the Azure portal on the "Cost Management + Billing" Overview](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-03.jpeg) ### Step 4 Paste the "Billing account ID" into the billingAccountName input field. ![Paste the "Billing account ID" into the billingAccountName input field](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-04.jpeg) ### Step 5 For the second input, we need to provide a random, unique GUID. We can generate one using the online GUID/UUID Generator website - [https://guidgenerator.com](https://guidgenerator.com). ![For the second input, we need to provide a random, unique GUID](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-05.jpeg) ### Step 6 Paste the GUID in the billingRoleAssignmentName input field. ![Paste the GUID in the billingRoleAssignmentName input field](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-06.jpeg) ### Step 7 The Parameters section is now done. We will now move onto providing a JSON object in the Body section. ![The Parameters section is now done. We will now move onto providing a JSON object in the Body section](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-07.jpeg) :::tip Copy this JSON object below. It has descriptive placeholders to clearly identify the segments that need to be replaced. ```json { "properties": { "principalId": "", "principalTenantId": "", "roleDefinitionId": "/providers/Microsoft.Billing/billingAccounts//billingRoleDefinitions/" } } ``` ::: ### Step 8 Replace `` with the same billingAccountId used in the "billingAccountName" parameter. In our example, it is "1111111". ![Replace the your-billing-accountId placeholder with the same billingAccountId used in the billingAccountName parameter — for example, "1111111"](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-08.jpeg) ### Step 9 Replace `` with "24f8edb6-1668-4659-b5e2-40bb5f3a7d7e". The reason for this specific value is explained in the next step. ![Replace the billing-role-definitionId placeholder with "24f8edb6-1668-4659-b5e2-40bb5f3a7d7e"](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-09.jpeg) ### Step 10 Note: "24f8edb6-1668-4659-b5e2-40bb5f3a7d7e" represents the role definition ID for the EnrollmentReader role. This role grants the Service Principal Name (SPN) read access to view your billing information. ![Note: "24f8edb6-1668-4659-b5e2-40bb5f3a7d7e" represents the role definition ID for the EnrollmentReader role](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-10.jpeg) ### Step 11 Then replace `` with your AD Tenant Id. You can locate it via: 1. Go to Azure Ad > App Registrations > Find the CloudMonitor Service Principal/App (Tip: paste the Service Principal's Client Id for filtering). 2. Replace `` with the "Directory (tenant) Id" field. 3. Stay on this page for a future step. ![Go to Azure AD > App Registrations and find the CloudMonitor Service Principal/App](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-11.jpeg) ### Step 12 Lastly, replace `` with the CloudMonitor Service Principal Managed Application resource Object ID. You can find it by: 1. Continuing from the last location & clicking on the Managed Application link. 2. Replace `` with the "Object ID". ![Continuing from the last location & clicking on the Managed Application link. 2. Replace the your-principal-Id placeholder with the "Object ID"](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-12.jpeg) ### Step 13 Your Body section should now look similar to the below: ![Your Body section should now look similar to the below:](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-13.jpeg) ### Step 14 Click "Run" – it should return a "200" Status Code if it made the association successfully.\ \ If it returns 400 error, then check all the fields again. If it returns a 403 error, then this usually means that the logged in user does not have permission to update the role assignment. Make sure you are logged in as Account Owner or Department Owner. Raise a helpdesk ticket if you cannot get a successful 200 response ![Raise a helpdesk ticket if you cannot get a successful 200 response](../../../../assets/docs/installing-cloudmonitor/allow-cloudmonitor-access-view-billing-information-ea-enterprise-agreement-customers-14.jpeg) :::tip You have successfully granted the read-only EnrollmentReader role to the CloudMonitor Service Principal. Please proceed with the next step:[Configuring Storage for CloudMonitor to schedule Exports : CloudMonitor Helpdesk](https://cloudmonitor.ai/docs/installing-cloudmonitor/configuring-storage-cloudmonitor-schedule-exports/) :::