How many subscriptions per tenant?

Question

How many subscriptions per tenant?

Raymond Dean 116

Is it true that every tenant needs at least 1 subscription?

So, if you have 10 active tenants, you will have 10 subscriptions.

You cannot link all you tenants to 1 subscription -- true?

"Tenant" and "Subscription" can be synonymous -- true?

From any tenant, in the Cost/Billing section, you can see ALL subscriptions for ALL tenants -- true?

Accepted answer

1 additional answer

Your answer

Answer 1

JamesTran-MSFT 36,911 Microsoft Employee Moderator

@Raymond Dean
Thank you for your post and I apologize for the delayed response!

Is it true that every tenant needs at least 1 subscription?

Every tenant does not need at least 1 subscription. You can have an Azure AD tenant without an Azure Subscription if you don't need to deploy any Azure Resources

You cannot link all you tenants to 1 subscription -- true?

All of your users have a single home directory (Azure AD tenant) for authentication. An Azure subscription has a trust relationship with Azure Active Directory (Azure AD). A subscription trusts Azure AD to authenticate users, services, and devices. Multiple subscriptions can trust the same Azure AD directory. Each subscription can only trust a single directory. One or more Azure subscriptions can establish a trust relationship with an instance of Azure Active Directory (Azure AD) in order to authenticate and authorize security principals and devices against Azure services. For more info - Associate or add an Azure subscription to your Azure Active Directory tenant.

"Tenant" and "Subscription" can be synonymous -- true?

No, tenant and subscription cannot be synonymous.
Azure Active Directory (Azure AD) is a cloud-based identity and access management service. Azure AD allows your employees to sign in and access resources.
An Azure Subscription is a logical container for your resources. Each Azure resource is associated with only one subscription. Creating a subscription is the first step in adopting Azure.

For more info:
What is Azure Active Directory?
Azure fundamental concepts
Associate or add an Azure subscription to your Azure Active Directory tenant

From any tenant, in the Cost/Billing section, you can see ALL subscriptions for ALL tenants -- true?

No, within the Cost/Billing section you'll only see the Subscriptions associated to the specific Azure AD tenant that you're currently viewing. If you want to view other subscriptions, you'll have to switch to that specific tenant.

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-07-26T17:06:26.377+00:00

@Raymond Dean
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
Raymond Dean 116 Reputation points

2022-07-27T02:34:02.007+00:00

@JamesTran-MSFT

For almost the last 30 days, I've been trying to fix a problem with my subscriptions, and I'm also trying to understand all of Microsoft's lingo. I've had a ticket open with Microsoft since the beginning of July, and I can't get an answer to my questions, nor do I fully comprehend your responses.

Basically, anytime I try to create a subscription under Tenant 2, I'm directed back to Tenant 1, with the warning, "In order to view your eligible offers, please click here to switch your directory to tenant1.onmicrosoft.com".

I own two domain names: Tenant1 for a live "Production" environment where I will host content publicly. Tenant2 as a "Development" environment for training and testing.

For the sake of simplicity, how many subscriptions do I need for this setup?
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-07-28T22:13:56.29+00:00
@Raymond Dean
Thank you for following up on this!

When it comes to your specific scenario - Tenant 1: Production and Tenant 2: Development, you'll need one subscription per tenant, since an Azure Subscription can only have a one to one (1:1) relationship with an Azure AD Tenant.

For more info - Associate or add an Azure subscription to your Azure Active Directory tenant.

When it comes to the error message that you're receiving - In order to view your eligible offers, please click here to switch your directory to tenant1.onmicrosoft.com.

Is Tenant 2 somehow linked to Tenant 1?

Is Tenant 2 a B2C tenant? If so, in you'll only be able to add new subscriptions to your Azure AD tenant (Tenant 1).

Screenshot from my B2C tenant

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
Raymond Dean 116 Reputation points

2022-07-29T15:04:02.463+00:00

@JamesTran-MSFT

Both Tenants were created with my Microsoft Account.

Under both Tenants, in AzureAD, you can see a Global Admin for each Tenant. These were automatically created. The Issuer is "MicrosoftAccount". Each Global Admin seems to be "attached" to my Microsoft Account. In the admin's profile, under "Identity" > "Issuer", clicking MicrosoftAccount opens the "Identities" blade. It says the MicrosoftAccount is "federated". No clue what this means.

Also, my Microsoft Account has been granted "Access management for Azure resources" (Screenshot below).
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-08-02T18:33:16.96+00:00
@RaymondDean-449
Thank you for following up on this!

Since you're only seeing this error within Tenant 2, is this tenant an Azure B2C tenant?

Because you opened a support request, can you share the request number, so I can gain a better understanding of your environment?

Can you also share a screenshot of your tenants similar to the below?

Navigate to Azure Active Directory -> Select Manage Tenants

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
Raymond Dean 116 Reputation points

2022-08-03T01:33:57.54+00:00

@JamesTran-MSFT

I can confirm that all Tenants are of type "Azure Active Directory".

Here's the case number: TrackingID#2207090040000172

At this point I'm ready to move on and stick with 1 tenant and 1 subscription.

I think my expectation was that I could manage all subscriptions via my Microsoft Account without having to create a separate Global Admin for each new Tenant.

At the end of the day, it's not a big deal, but I suppose this scenario should be documented somewhere on Microsoft's website... Or, perhaps Microsoft can create a "Subscription Best Practices & Recommendations" for individual developers, freelancers, testers, and folks who are training.
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-08-03T21:22:41.073+00:00

@Raymond Dean
Thank you for following up on this!

I reached out to my team and have created a work item for our documentation authors for this scenario, so that others experiencing a similar issue can easily find a "Subscription Best Practices & Recommendations" article.

Additional links for your reference:
Subscription decision guide
Organize and manage multiple Azure subscriptions

Thank you again for your time and patience throughout this issue!
Anthony Rusonik 1 Reputation point

2023-05-31T16:37:39.0566667+00:00

Good answer from Raymond "All of your users have a single home directory (Azure AD tenant) for authentication. An Azure subscription has a trust relationship with Azure Active Directory (Azure AD). A subscription trusts Azure AD to authenticate users, services, and devices. Multiple subscriptions can trust the same Azure AD directory. Each subscription can only trust a single directory." CORRECT

Answer 2

Hi @Raymond Dean

Here is a really good explanation of tenant vs subscription (no they are not synonymous):

When you associate a subscription with a different directory, users that have roles assigned using Azure role-based access control lose their access. Classic subscription administrators, including Service Administrator and Co-Administrators, also lose access.

Moving your Azure Kubernetes Service (AKS) cluster to a different subscription, or moving the cluster-owning subscription to a new tenant, causes the cluster to lose functionality due to lost role assignments and service principal's rights. For more information about AKS, see Azure Kubernetes Service (AKS).

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory

If you have more in-depth questions about billing and subscription managenet, I would recommend creating a ticket with Azure at https://azure.microsoft.com/en-ca/support/create-ticket/

--------------------------

If this is helpful please mark as correct answer.

Share via

How many subscriptions per tenant?

1 additional answer

Your answer