Issue Creating Azure Subscriptions via ALZ Subscription Vending Module

For Microsoft Customer Agreement (MCA) billing, subscription creation via Terraform (or any automation) must use the correct billing scope and permissions on the invoice section, not just generic high-level roles.

From the error returned by the API:

{
  "code": "InsufficientPermissionsOnInvoiceSection",
  "message": "Cannot create subscription since either invoice section is not found or you do not have sufficient permissions under the provided invoice section. Try again with a different invoice section or contact invoice section owner for permissions"
}

the platform is explicitly failing authorization at the invoice section level.

Based on the provided documentation, the key technical requirements are:

1. Use the correct invoice section billing scope when creating the subscription
   • For MCA, the subscription creation API requires the full invoice section scope, for example: /providers/Microsoft.Billing/billingAccounts/{billingAccountId}/billingProfiles/{billingProfileId}/invoiceSections/{invoiceSectionId}
   • The documented flow is:
     1. List billing profiles and invoice sections:

                az billing profile list --account-name "{billingAccountId}" --expand "InvoiceSections"
        

     2. Use the id property of the target invoice section as the billingScope when creating the subscription.
   • If the ALZ subscription vending module is not using the exact id of the invoice section returned by this API, the platform will return InsufficientPermissionsOnInvoiceSection even if permissions look correct elsewhere.
2. Create the subscription via the supported MCA APIs/commands
   • For MCA, the supported programmatic path is via Microsoft.Subscription/aliases using either:
     • PowerShell: New-AzSubscriptionAlias with the MCA billing scope, or
     • Azure CLI: az account alias create with the MCA billing scope.
   • Both return a payload like:

          {
            "id": "/providers/Microsoft.Subscription/aliases/sampleAlias",
            "name": "sampleAlias",
            "properties": {
              "provisioningState": "Succeeded",
              "subscriptionId": "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
            },
            "type": "Microsoft.Subscription/aliases"
          }
     

   • The ALZ Terraform module must ultimately call into this alias API (or equivalent) with the correct billingScope. If it is using an EA-style flow or a wrong scope, MCA will reject it with the invoice section error.
3. Permissions must exist specifically on the invoice section
   • The error is raised when either:
     • The invoice section ID used is invalid/not found, or
     • The caller lacks the required role on that invoice section.
   • The documentation shows that the subscription is created for an invoice section, not just for a billing account or billing profile. The service principal must have the appropriate MCA billing role on that invoice section (for example, the role that allows subscription creation for that invoice section).
   • Assigning broad roles like “Billing Account Owner” alone is not sufficient if the invoice section-level role required for subscription creation is missing or the wrong invoice section ID is used.
4. MCA account type (“Individual”) and ALZ subscription vending
   • The documentation for MCA programmatic subscription creation does not introduce a separate flow for “Individual” vs other MCA account types; it focuses on:
     • Correctly identifying billing profiles and invoice sections.
     • Using the MCA billing scope in the alias API.
   • The critical factor is therefore billing scope and invoice section permissions, not the ALZ module itself.
5. Concrete checks and recommendations for this scenario
   • Verify that the Terraform configuration (or the ALZ module variables) is passing exactly the invoice section id returned by:

          az billing profile list --account-name "{billingAccountId}" --expand "InvoiceSections"
     

   • Confirm that the service principal used by Terraform has the required MCA billing role on that specific invoice section, not only at billing account or billing profile level.
   • If needed, test outside Terraform using:
     • New-AzSubscriptionAlias with the same billingScope the module uses, or
     • az account alias create with that billingScope. If these commands fail with the same InsufficientPermissionsOnInvoiceSection error, the issue is definitively at the MCA billing/permissions layer, not in Terraform or ALZ.
   • Once the alias creation works via CLI/PowerShell with the same scope and identity, align the ALZ module configuration to use that working scope and identity.

These steps align the ALZ subscription vending module with the documented MCA subscription-creation flow and address the specific InsufficientPermissionsOnInvoiceSection error by focusing on the invoice section scope and permissions.

References:

• Programmatically create Azure subscriptions for a Microsoft Customer Agreement with the latest APIs
• Subscription vending implementation guidance
• Subscription vending