Azure Active Directory

Question

I work for a CSP, added a new customer to our marketplace, customer has an existing M365 account, the customer contact is the global admin for his company. He created a new Azure subscription, under that subscription he can see his Identity as global admin, but he has read only access, so he cannot create resources in Azure. How does he change his Azure identity to give him full amdin rights like what he has for his M365 subscription?

Answer 1

You could follow along here.
https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/add-change-subscription-administrator

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

@Vincent Van Gent
Thank you for your post!

I understand that you work for a CSP and added a new customer (Global Admin) to your marketplace. This new customer then created a new Azure Subscription but only has read access (I'm assuming through the Azure AD Elevate access feature) and can't create any resources within that Subscription.

Because Azure AD and Azure resources are secured independently from one another - Azure AD role assignments do not grant access to Azure resources, and Azure role assignments do not grant access to Azure AD, the customer will need to assign their user the appropriate RBAC role for the new subscription in order to create resources within Azure.

Assign Azure roles using the Azure portal:

• Sign into the Azure portal.
• In the Search box at the top, search for the scope you want to grant access to (i.e. Subscriptions, or a specific Resource group within the subscription)
• Once the appropriate Subscription is selected open the Access Control (IAM) page.
• Click Add and select Add role assignment.
• Select the appropriate role (i.e. Owner), select the user who needs access, and review + assign. For more info - Azure built-in roles.

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.