Quick one today – if you are trying to configure a spending policy for Copilot Cowork and see the error ‘Failed to assign Contributor on /subscriptions/… Request failed with status 403, this thankfully isn’t too cryptic in what it needs – the user performing this request needs to have at least Contributor access on the Azure Subscription that the policy is pointing to.

Microsoft have a tutorial on how to grant this here: https://learn.microsoft.com/en-us/azure/role-based-access-control/quickstart-assign-role-user-portal

During my testing, this applied when there was an existing spending policy already created by someone else, and other user wanted to make changes.

Giving a user the AI Administrator role should allow a user to create/modify spending policies and avoid the above issue as per https://learn.microsoft.com/en-us/microsoft-365/copilot/usage-based-billing-manage-copilot-credits:

Global administrator and Billing administrator roles have access to add, select, and change billing methods, and set billing methods in policies.

AI administrator and License administrator roles have access to create spending policies, manage limits and alerts, and view the Cost management dashboard. They can’t set or modify the billing method.

… but despite an account having AI Administrator, I still ran into the issue. On top of this, the Cowork Copilot Settings deployment essentials advised there was no AI Administrator role in the org, yet when using the ‘Review and assign role’ button it then showed that I did in fact, have AI Administrator. Despite refreshing it didn’t update the 0 value for ‘AI Administrators in your org’ and had waited 24 hours already, so there appears to be a few bugs around in the early days of this release.