How to share an Azure account with a small team?

RP 1

Hello everyone,

5 colleagues of mine and I are working on a project together that we'd like to use Azure ML, IOT and web services as infrastructure. I have an existing account with a "Default" Directory. However, I'd like to create a dedicated space for our project and one of my colleagues would be the Billing Admin.

Unfortunately, I just don't understand how I'm supposed to properly set up a shared account.

My current approach is/was

Use my personal account
Create an Azure Active Directory (AD)
Add my colleagues to that new directory

However, some of the problems I found is:
P1. Colleagues cannot create subscriptions
P2. Colleagues cannot add payment information (only I can?)
P3. And the permissions are tricky, the admin permissions from Azure AD didn't allow them to do anything and they weren't able to use a subscription I moved from my default directory to the "shared" Azure AD. So I had to fiddle with the permissions on the subscription and was able to make it usable for them somehow

Please let me know if any of you can think of a better approach or where my approach is wrong?

I've been looking at:

James Hamil 24,746 Reputation points Microsoft Employee

2020-11-05T22:32:21.61+00:00

Hi, we are investigating your issue and will update you shortly!
James Hamil 24,746 Reputation points Microsoft Employee

2020-11-06T23:18:32.37+00:00

Hi, are you a Global admin? If so, try changing the permissions of your colleagues to local admins.
RP 1 Reputation point

2020-11-09T17:13:26.997+00:00

Hi @James Hamil ,
Thanks a lot for your response. Yes I'm a global administrator. I invited my colleagues and also made them global administrators.

The "assigned roles" section doesn't give me an option to define my colleagues as "local" admins. I was only able to find "global administrator".

The article mentions "Local Administrator account: The administrator who is installing Azure AD Connect and who has local Administrator permissions on the machine." What is the machine in this scenario, we do not have a physical/virtual server that uses this Azure AD, so I'm not entirely sure we'd even need a local administrator account.

----
Just to double check - is creating an entire new Azure ActiveDirectory the correct approach to create a collaborative "workspace" for my colleagues and I or is my approach unadvised here?
RP 1 Reputation point

2020-11-09T17:42:09.33+00:00

I just noticed, maybe I need to assign the users Azure AD licenses, unless that's irrelevant for the usage of Azure ML, web services and management of subscriptions?
James Hamil 24,746 Reputation points Microsoft Employee

2020-11-10T01:49:05.86+00:00

Hi, are your Colleagues receiving an error message? If so, what error? Can they try creating a subscription through [Cloudshell][1] or PowerShell?

To change billing info you need to be a Global or Billing Admin: https://learn.microsoft.com/en-us/microsoft-365/commerce/billing-and-payments/manage-payment-methods?view=o365-worldwide#before-you-begin

When it comes to AzureAD and RBAC permissions, there are differences between them, which is why the customer is getting confused/having a hard time:
https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles#how-the-roles-are-related

I hope this helps, please let me know if I can clarify anything else!
RP 1 Reputation point

2020-11-10T20:08:12.72+00:00

Thanks for the links

Subscriptions: Well even I cannot add a subscription to the non-default Azure Active Directory. Whenever I go to subscriptions, it redirects to the default directory and if I manually switch it to the non-default Directory it asks me to switch back in order to add/modify subscriptions.

Payment Methods: When I'm in the "team" Azure Active Directory, which I created and I'm a global admin of, I see an error message saying "Payment methods are managed by your Account Admin". Since I cannot add a payment method to the team/shared Azure Active Directory I switched back to my default directory, where I am able to modify payment methods. So I wonder, would our billing admin just add the payment method to their personal account, add a subscription and then transfer the subscription into our shared Azure Active Directory? Since it doesn't seem to be possible to create the payment and subscription inside the shared Azure Active Directory.
James Hamil 24,746 Reputation points Microsoft Employee

2020-11-26T00:45:46.897+00:00

Hi, do you still require assistance? If not, please mark the answer as verified.

Thank you,
James

1 answer

James Hamil 24,746 Reputation points Microsoft Employee

2020-11-13T23:39:11.287+00:00

The user should be a billing/GA admin on the other tenant as well where they are trying to link a subscription. Also, Multiple subscriptions can trust the same Azure AD directory but Each subscription can only trust a single directory. ( https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory)
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to share an Azure account with a small team?

1 answer

Your answer