I am in the co-administrator group for an Azure enterprise subscription but I am not a Global Administrator for the Default Azure Active Directory.

In the classic Azure Portal I have privileges to create my own Azure Active Directory. I can also create an app/Service Principal for that AAD and configure it accordingly.

However when I try to assign the application to role I can't find the application when I search. Probably because it's part of the newly created AAD and not in the one tied to the Azure Enterprise subscription.

Is there a way to circumvent this or do I have to be Global Administrator and add the application to the Default AAD that is connected to the Azure Enterprise Subscription?

2 Answers 2


The easiest way to change the directory that is backing an Azure account is to put in a support ticket to have it done.

Barring that, you have to be an Account administrator on the subscription and a global admin on the new tenant in order to make the switch in the portal.

  • I don't think I will be able to do that request since I'm not allowed to mess around with that directory. Also, that was one of the requirements - to be able to create a new directory and have that directory have an instance of my Service Principal app. May 31, 2016 at 11:56

You can get permissions to add applications to the directory you're not any kind of an admin of, and then you will be able to create your service principal in that directory. If doing this with scripting, make sure you specify the tenant ID of the directory you want to create the app in when you Login-AzureRMAccount.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.