How my colleague can add my existing Microsoft account (which is already Owner and Coadmin of his subscription) as a full Member (and not a guest user) and a Global administrator of his Azure directory so I can create Automation accounts in his subscription?
I am managing colleague's Azure resources. I had been invited to his account as a coadministrator and owner role and indeed under subscription's Access control (IAM) I see my Type as Owner and Role as Owner, Co-administrator.
But when I attempt to create an Automation account to start/stop VMs in my colleague's subscription, I see the warning:
You do not have permissions to create a Run As account in Azure Active Directory. Please follow the directions in the documentation to learn how to create a Run As account. Click here to learn more about Run As accounts.
The article tells the following:
If you aren't a member of the subscription’s Active Directory instance before you are added to the subscription's global administrator/coadministrator role, you are added to Active Directory as a guest. In this scenario, you see this message on the Add Automation Account page: “You do not have permissions to create." If a user is added to the global administrator/coadministrator role first, you can remove them from the subscription's Active Directory instance, and then re-add them to the full User role in Active Directory.
Indeed, in my colleague's Active Directory I am displayed as User Type: Guest. So, we tried to do as described - removed the user account from the Active Directory and tried to add a new user, but unfortunately my existing Microsoft account name (the same with which I'm registered as a Owner and Coadmin of colleague's subscription) is not accepted - it says that "gmail.com is not a verified domain in this directory".
So we tried the other button - New guest user. After that under Directory Role I was assigned "Global administrator" role. Azure accepted my email, but it failed to associate my existing Microsoft account and instead I received a new invitation and got a new Work account for the same email address. And when I log in with that, I don't see any subscriptions at all although I can access colleague's resources. And my old Microsoft account does not have any access to colleague's Active Directory (expected - because it was removed from there and a new Work account with the same email was created).