Azure Billing Hierarchy Is Confusing? Understand MCA Billing Scopes

Published on:
#governance

Azure uses similar words for different billing concepts. This makes it easy to select the wrong scope in Cost Analysis, grant a role at the wrong level, or pass an incomplete billing ID to a subscription-vending workflow.

CloudTrips uses a Microsoft Customer Agreement (MCA). Its billing hierarchy determines who pays, how invoices are produced, where subscription charges appear, and who may create new subscriptions.

Start with the Hierarchy

The MCA billing hierarchy looks like this:

Billing account
└── Billing profile
    ├── Invoice section
    │   ├── Azure subscription
    │   └── Azure subscription
    └── Invoice section
        └── Azure subscription

For CloudTrips, a simple target structure could be:

MCA billing account
└── Billing profile: Dmytro Klymenko
    ├── Invoice section: CloudTrips
    │   ├── CloudTrips DEV
    │   └── CloudTrips TEST
    └── Invoice section: Other workloads

The billing account, billing profile, and invoice section are all examples of billing scopes. A billing scope is not an additional box above the hierarchy. It means the boundary currently selected for viewing costs, assigning billing roles, or performing a billing operation.

1. Billing Scope: Which Boundary Am I Using?

Billing scope is a general term. When the Azure portal asks you to select a billing scope, it can mean a billing account, billing profile, or invoice section that you are allowed to access.

It solves this problem:

Which set of charges, settings, and billing permissions should this operation use?

The selected scope changes the result:

  • billing-account scope covers the commercial account
  • billing-profile scope combines the costs that belong to one invoice
  • invoice-section scope shows one subdivision of that invoice
  • subscription scope shows one Azure environment’s cost
  • resource-group scope shows only the resources inside that group

For the CloudTrips FinOps dashboard, the billing profile is the useful billing scope because leadership needs a combined view. The view can then be filtered to CloudTrips DEV and CloudTrips TEST.

For subscription vending, billing scope means something more specific: the full resource ID of the invoice section that will receive the new subscription’s charges.

2. Billing Account: Who Has the Agreement with Microsoft?

The billing account is the top of the MCA hierarchy. It represents the organization’s commercial relationship with Microsoft.

It solves these problems:

  • provides one parent for the organization’s billing profiles
  • records the agreement and organization-level billing information
  • allows central finance or IT administrators to view and govern billing access
  • provides the highest billing-role boundary

Use the billing-account scope when a finance administrator needs visibility across every billing profile or must manage account-level access. Do not create another billing account simply to separate DEV and TEST costs.

A billing account does not contain Azure resources directly. The resources remain inside Azure subscriptions.

3. Billing Profile: How Is the Invoice Paid?

A billing profile represents an invoice and its payment configuration. Each profile contains one or more invoice sections.

It solves these problems:

  • produces a separate invoice for the charges associated with the profile
  • defines payment method and billing address information
  • gives finance staff one place to view and pay that invoice
  • combines costs from several invoice sections for leadership reporting

Create another billing profile only when the organization needs a genuinely separate invoice or payment arrangement. Separate teams, projects, or environments usually need invoice sections—not separate billing profiles.

For CloudTrips, one billing profile is sufficient when DEV, TEST, and other workloads are paid through the same invoice and payment method.

4. Invoice Section: Where Should the Cost Appear on the Invoice?

An invoice section is a subdivision inside a billing profile. It groups subscription and product charges into a recognizable section of the same invoice.

It solves these problems:

  • separates costs by team, department, project, product, or environment
  • shows that grouping clearly on the billing-profile invoice
  • delegates who may create subscriptions whose costs belong to the section
  • provides a narrower Cost Analysis scope for the section owner

An invoice section does not create a separate invoice or payment method. All sections within one billing profile still roll up to the profile’s invoice.

An Azure subscription is associated with one invoice section at a time. The usage and purchases associated with that subscription are charged to that section.

The CloudTrips DEV and CloudTrips TEST subscriptions can share one CloudTrips invoice section when they have the same financial owner. Use separate DEV and TEST sections only when finance needs those environments displayed and delegated separately on the invoice.

Where the Subscription Fits

The Azure subscription is the bridge between billing and resource governance:

Billing view                           Governance view

Billing profile                       Management group: CloudTrips
└── Invoice section                   └── Management group: Online
    ├── CloudTrips DEV                    ├── CloudTrips DEV
    └── CloudTrips TEST                   └── CloudTrips TEST

These are two views of the same subscriptions:

  • the billing hierarchy determines who receives and organizes their charges
  • the management-group hierarchy determines inherited Azure Policy and Azure RBAC governance

Moving a subscription under the Online management group does not move it to another invoice section. Changing its invoice section does not change the policies inherited from Online.

Billing roles are also separate from normal Azure RBAC roles. Being Owner of an Azure subscription does not automatically make a user the owner of its billing profile.

Choose the Correct Level

Use the billing account when you need:

  • organization-wide billing administration
  • visibility across all billing profiles
  • control of the highest-level MCA billing roles

Use the billing profile when you need:

  • one complete invoice view
  • payment and invoice management
  • a leadership cost view across its invoice sections and subscriptions

Use an invoice section when you need:

  • a team, project, or environment shown separately inside the invoice
  • delegated subscription creation
  • cost analysis limited to that cost grouping
  • the billing scope for an automated subscription-vending request

Use an Azure subscription when you need:

  • an isolated Azure environment such as DEV, TEST, or PROD
  • resource deployment, Azure RBAC, quotas, policies, and subscription-level budgets
  • cost analysis for only that environment

Understand the Relevant Roles

Billing roles apply at billing scopes and are different from Azure resource roles.

Typical responsibilities are:

Billing account owner
Manages the overall billing account and its billing access.

Billing profile owner or contributor
Manages the invoice, payment configuration, and profile access.

Billing profile reader
Reads the profile's invoices and cost information.

Invoice section owner or contributor
Manages one invoice section and its billing access.

Azure subscription creator
Creates subscriptions billed to a specific invoice section.

Grant the narrowest role at the narrowest billing scope that solves the task. A vending service principal normally needs Azure subscription creator on the target invoice section; it does not need ownership of the entire billing account.

Understand IDs Used by Automation

The names shown in the portal are friendly display names. Automation usually needs IDs.

For MCA subscription vending, the invoice-section billing scope has this structure:

/providers/Microsoft.Billing/
  billingAccounts/{billing-account-id}/
  billingProfiles/{billing-profile-id}/
  invoiceSections/{invoice-section-id}

Written as one line, this full resource ID becomes the value of AZURE_BILLING_SCOPE.