The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Azure Enterprise Agreement (EA) administration has six billing and enrollment roles: Enterprise Administrator, Enterprise Administrator (read only), EA Purchaser, Department Administrator, Department Administrator (read only), and Account Owner. These roles govern the EA hierarchy, purchasing, usage and subscription provisioning; they are separate from Azure role-based access control (RBAC) on subscriptions and resources.
The six Azure EA roles at a glance
Microsoft’s current Azure EA billing documentation lists six distinct roles. The scope and limits below apply to the role catalog documented by Microsoft Learn in 2026.
| Role | Scope | Write authority | Purchasing | Subscriptions and RBAC | Visibility | User limit |
|---|---|---|---|---|---|---|
| Enterprise Administrator | Entire enrollment | Manage accounts, account owners, departments, administrators, contacts and enrollment settings | Can purchase Azure services, reservations and savings plans | Can provision subscriptions under active enrollment accounts, but does not receive general resource access through the EA role | Organization-wide usage and unbilled charges, reservations and savings plans | Unlimited |
| Enterprise Administrator (read only) | Entire enrollment | View only | Cannot purchase | Cannot make enrollment or resource-authority changes | Enrollment, reservation and savings-plan information | Unlimited |
| EA Purchaser | Enrollment purchasing | Cannot manage accounts | Can purchase Azure services, reservations and savings plans | No general subscription or resource access from this billing role | Usage and unbilled charges | Unlimited; currently documented for service-principal-name access |
| Department Administrator | Managed departments | Create and manage departments; create account owners | Not an enrollment-wide purchasing role | No general subscription or resource access from this billing role | Usage for managed departments | Unlimited |
| Department Administrator (read only) | Managed departments | View department information only | Cannot purchase | No general subscription or resource access from this billing role | Department information | Unlimited |
| Account Owner | One enrollment account | Create and manage subscriptions; manage subscription role assignments | Authority is tied to the account rather than enrollment-wide purchasing | Subscription ownership for subscriptions provisioned under that account, including assigning Azure roles | Usage for the account’s subscriptions | One user per enrollment account |
What each role is for
Enterprise Administrator
This is the highest-privilege EA enrollment role. It is intended for the people who operate the agreement itself: they can maintain accounts and account owners, create and manage departments, administer other EA contacts, review organization-wide usage and unbilled charges, buy Azure services, and place reservation or savings-plan orders. An Enterprise Administrator can create a subscription under any active enrollment account.
“Manage subscriptions” in the EA portal means enrollment and billing provisioning. It does not automatically make the administrator an Azure subscription Owner or grant access to resources inside that subscription.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems#1 Best Overall
Enterprise Administrator (read only)
Use this role for audit, finance or reporting staff who need to inspect enrollment, reservation and savings-plan information without the ability to alter the agreement or make purchases. It is a read-only view of the enrollment-level information exposed by the EA administration experience.
EA Purchaser
EA Purchaser separates buying authority from account administration. The role can purchase Azure services, reservations and savings plans and can view usage and unbilled charges, but cannot manage enrollment accounts. Microsoft currently documents EA Purchaser for service-principal-name access, making it useful for controlled purchasing automation. A service principal with this EA role still does not become an Azure RBAC principal on subscriptions or resources.
Department Administrator
A Department Administrator owns the departmental layer of the EA hierarchy. The role can create and manage departments, create account owners, and view usage for departments it manages. It is suitable when business units need to organize their own accounts without receiving enrollment-wide authority.
Department Administrator (read only)
This role exposes department information without permitting departmental changes. It fits oversight and reporting scenarios where the user should not create departments or account owners.
Account Owner
An Account Owner is the operational owner of one enrollment account. The role can create and manage that account’s subscriptions, manage subscription role assignments, and view usage for those subscriptions. Microsoft limits each enrollment account to one Account Owner.
An Account Owner can create subscriptions for the account. If the subscription is created for another user, Microsoft’s workflow can require that recipient to approve the subscription before provisioning completes.
Rank #3
Enterprise Administrator versus Account Owner
The practical distinction is enrollment-wide administration versus account-scoped subscription ownership.
- Enterprise Administrator: manages the EA structure and purchasing across the enrollment and can provision subscriptions under active accounts.
- Account Owner: manages subscriptions and their Azure role assignments for one account and is the relationship that connects the enrollment account to subscription ownership.
An Enterprise Administrator therefore can create a subscription without becoming its Azure resource administrator. To control virtual machines, storage, networking or other resources, assign appropriate Azure RBAC roles separately. The Account Owner’s subscription-role-management capability is the exception that connects the account-owner relationship to Azure subscription authorization.
Who can create an Azure EA subscription?
- An Enterprise Administrator can create a subscription under any active enrollment account.
- An Account Owner can create subscriptions for the enrollment account they own.
- If an Account Owner provisions a subscription for another user, the designated recipient may need to approve it in Microsoft’s workflow.
The hierarchy is: accounts belong to departments, and subscriptions belong to accounts. That hierarchy determines which Account Owner can manage a subscription after it is provisioned.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.EA billing roles are not Azure resource permissions
A finance employee can be an Enterprise Administrator for billing while having no Owner, Contributor or other Azure RBAC assignment. Conversely, a resource administrator can operate workloads without having permission to change EA billing settings.
Use Microsoft Entra ID and Azure RBAC for directory, subscription and resource authorization. EA-specific API roles and identifiers exist for the enrollment roles, and service-principal assignment can support automation, but assigning an EA API role does not confer general resource access.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Best Value
- Used Book in Good Condition
Identity, limits and lifecycle details
User assignment and group restrictions
Microsoft’s cited EA role guidance assigns these billing roles to individual user accounts; it does not support assigning them to distribution groups or security groups. Design individual administrators and automate only where the documented service-principal option applies.
Account limits
Enterprise Administrator, Enterprise Administrator (read only), EA Purchaser, Department Administrator and Department Administrator (read only) have unlimited users in Microsoft’s role-limit table. Each enrollment account can have only one Account Owner.
Work or School account requirement
As of October 1, 2026, new EA billing-role assignments must use Work or School accounts managed through Microsoft Entra ID. Microsoft states that existing personal-account assignments are unaffected at that point, subject to later transition guidance.
Retired classic administrator roles
Classic Account Administrator, Service Administrator and Co-Administrator are not current EA choices. Microsoft’s RBAC guidance says classic roles were retired on August 31, 2024, with full retirement by May 2026. Use Azure RBAC for current subscription and resource authorization.
Recommended Free Tools
Choosing the least-privilege role
- Choose Enterprise Administrator for enrollment-wide structure, contacts, purchasing and provisioning.
- Choose Enterprise Administrator (read only) for enrollment reporting without change rights.
- Choose EA Purchaser when purchasing is needed but account administration is not; use the documented service-principal path for automation.
- Choose Department Administrator to delegate departmental organization and account-owner creation.
- Choose Department Administrator (read only) for departmental visibility only.
- Choose Account Owner for one account’s subscription lifecycle and subscription-role assignments, remembering the one-user limit.
After selecting an EA role, review Azure RBAC and Microsoft Entra assignments independently. The billing role answers “who can administer the agreement?”; RBAC answers “who can access this subscription or resource?”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
