1

How my colleague can add my existing Microsoft account (which is already Owner and Coadmin of his subscription) as a full Member (and not a guest user) and a Global administrator of his Azure directory so I can create Automation accounts in his subscription?

I am managing colleague's Azure resources. I had been invited to his account as a coadministrator and owner role and indeed under subscription's Access control (IAM) I see my Type as Owner and Role as Owner, Co-administrator.

But when I attempt to create an Automation account to start/stop VMs in my colleague's subscription, I see the warning:

You do not have permissions to create a Run As account in Azure Active Directory. Please follow the directions in the documentation to learn how to create a Run As account. Click here to learn more about Run As accounts.

The article tells the following:

If you aren't a member of the subscription’s Active Directory instance before you are added to the subscription's global administrator/coadministrator role, you are added to Active Directory as a guest. In this scenario, you see this message on the Add Automation Account page: “You do not have permissions to create." If a user is added to the global administrator/coadministrator role first, you can remove them from the subscription's Active Directory instance, and then re-add them to the full User role in Active Directory.

Indeed, in my colleague's Active Directory I am displayed as User Type: Guest. So, we tried to do as described - removed the user account from the Active Directory and tried to add a new user, but unfortunately my existing Microsoft account name (the same with which I'm registered as a Owner and Coadmin of colleague's subscription) is not accepted - it says that "gmail.com is not a verified domain in this directory".

So we tried the other button - New guest user. After that under Directory Role I was assigned "Global administrator" role. Azure accepted my email, but it failed to associate my existing Microsoft account and instead I received a new invitation and got a new Work account for the same email address. And when I log in with that, I don't see any subscriptions at all although I can access colleague's resources. And my old Microsoft account does not have any access to colleague's Active Directory (expected - because it was removed from there and a new Work account with the same email was created).

1

After a bunch of trials and errors and pulling my hear out, I found that the culprit is this one: https://cloudblogs.microsoft.com/enterprisemobility/2016/09/15/cleaning-up-the-azure-ad-and-microsoft-account-overlap/

So, it seems that now we cannot add Microsoft accounts to Azure Directory as full members (only as guests) and we have to add them with domain of @targetazuredomain.onmicrosoft.com, then reset user's password in Azure, send the temporary password to the user and now the user should log in to Azure Portal with this new domain name name.surname@targetazuredomain.onmicrosoft.com. Password change dialog will be displayed, user has to change the password and finally will have access to the resources and will be able to create new Automation accounts with RunAs accounts.

To give this user subscription Owner permissions, the admin has to add the user with the name.surname@targetazuredomain.onmicrosoft.com once more to Access control (IAM) list with Owner role. So you might end up with two accounts in IAM list - one for Microsoft account and the other one for local AD account; but the one with Microsoft account is not that useful anymore because it has no access to subscription's Azure Domain.

Essentially, this means that Microsoft account SSO for Azure is dead - you cannot log on to multiple Azure subscriptions and expect to have full permissions there. You have to switch to the "genuine domain" account for every subscription you don't own.

  • 1
    Your best option is just to stop using Microsoft accounts, they really are the poor stepchild in Azure auth scenarios nowadays (I'm not saying I agree with this, but that is how it is). If you use a full Azure AD account which is in a different tenant then you can add them as guest members and subscription owners with much less friction. – Sam Cogan Mar 11 '18 at 20:55

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.