{"id":83,"date":"2017-06-13T08:33:27","date_gmt":"2017-06-13T06:33:27","guid":{"rendered":"https:\/\/msb365.abstergo.ch\/?p=83"},"modified":"2019-02-22T10:04:00","modified_gmt":"2019-02-22T08:04:00","slug":"add-or-change-azure-administrator-roles-that-manage-the-subscription-or-services","status":"publish","type":"post","link":"https:\/\/www.msb365.blog\/?p=83","title":{"rendered":"Add or change Azure administrator roles that manage the subscription or services"},"content":{"rendered":"<div class=\"container mainContainer\" dir=\"ltr\" lang=\"en-us\" data-bi-name=\"body\">\n<div id=\"main\">\n<div>\n<div class=\"content\">\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"038cac2e573965b819ca7c4655414057:0\">You can change the Azure administrator that manages your Azure subscription or manages the Azure services used in your subscription. To view Azure billing information and manage subscriptions, you must sign in to the <a href=\"https:\/\/account.windowsazure.com\/Home\/Index\" data-linktype=\"external\">Account Center<\/a> as the Account Administrator. <span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"038cac2e573965b819ca7c4655414057:0\">+ <\/a><\/span><\/p>\n<h2 id=\"add-an-admin-for-a-subscription\">Add an admin for a subscription<\/h2>\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"0f84ac6c473767fc1149f8e601c34a5f:0\">You can add an Azure administrator in the Azure portal or in the Azure classic portal.<span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"0f84ac6c473767fc1149f8e601c34a5f:0\">+ <\/a><\/span><\/p>\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"4e00802820073040301808f201c18000:0\"><strong>Azure portal<\/strong><span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"4e00802820073040301808f201c18000:0\">+ <\/a><\/span><\/p>\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"2f80acec7bb7e6f83149f1634f01435f:0\">To add someone as an admin for a subscription in the Azure portal, you give them the owner role. The owner role can only manage the resources in the subscription that you assigned. It doesn&#8217;t have access privilege to other subscriptions. The owners you add through the <a href=\"https:\/\/portal.azure.com\/\" data-linktype=\"external\">Azure portal<\/a> can&#8217;t manage resource in the <a href=\"https:\/\/manage.windowsazure.com\/\" data-linktype=\"external\">Azure classic portal<\/a>.<span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"2f80acec7bb7e6f83149f1634f01435f:0\">+ <\/a><\/span><\/p>\n<ol class=\"lf-text-block lf-block\" data-lf-anchor-id=\"8d93a829d89e628d3949c8c745074373:0\">\n<li style=\"list-style-type: none;\">\n<ol class=\"lf-text-block lf-block\" data-lf-anchor-id=\"8d93a829d89e628d3949c8c745074373:0\">\n<li>Sign in to the <a href=\"https:\/\/portal.azure.com\/\" data-linktype=\"external\">Azure portal<\/a>.<\/li>\n<li>On the Hub menu, select <strong>Subscription<\/strong> &gt; <em>the subscription that you want the admin to access<\/em>.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-gb\/azure\/billing\/media\/billing-add-change-azure-subscription-administrator\/newselectsub.png\" alt=\"Screenshot that shows a selected subscription\" data-linktype=\"relative-path\"><\/li>\n<li>In the subscription blade, select <strong>Access control (IAM)<\/strong>&gt; <strong>Add<\/strong>.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-gb\/azure\/billing\/media\/billing-add-change-azure-subscription-administrator\/newsettings.png\" alt=\"Screenshot that shows the Add button selected\" data-linktype=\"relative-path\"><\/li>\n<li>Select <strong>Select a role<\/strong> &gt; <strong>Owner<\/strong>.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-gb\/azure\/billing\/media\/billing-add-change-azure-subscription-administrator\/newselectrole.png\" alt=\"Screenshot that shows the Owner role selected\" data-linktype=\"relative-path\"><\/li>\n<li>Type the email address of the user you want to add as owner, click the user, and then click <strong>Select<\/strong>.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-gb\/azure\/billing\/media\/billing-add-change-azure-subscription-administrator\/newadduser.png\" alt=\"Screenshot that shows a user email added and selected\" data-linktype=\"relative-path\"><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<p><span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"8d93a829d89e628d3949c8c745074373:0\">+ <\/a><\/span><\/p>\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"ffc4c43c71b7f6f53558d8f625c58b58:0\"><strong>Azure classic portal<\/strong><span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"ffc4c43c71b7f6f53558d8f625c58b58:0\">+ <\/a><\/span><\/p>\n<ol class=\"lf-text-block lf-block\" data-lf-anchor-id=\"8bd4ac20d59c62f919cdc9e741024353:0\">\n<li style=\"list-style-type: none;\">\n<ol class=\"lf-text-block lf-block\" data-lf-anchor-id=\"8bd4ac20d59c62f919cdc9e741024353:0\">\n<li>Sign in to the <a href=\"https:\/\/manage.windowsazure.com\/\" data-linktype=\"external\">Azure classic portal<\/a>.<\/li>\n<li>In the navigation pane, select <strong>Settings<\/strong>&gt; <strong>Administrators<\/strong>&gt; <strong>Add<\/strong>.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-gb\/azure\/billing\/media\/billing-add-change-azure-subscription-administrator\/addcoadmin.png\" alt=\"Screenshot that shows how to get to the add button\" data-linktype=\"relative-path\"><\/li>\n<li>Type the email address of the person you want to add as Co-administrator and then select the subscription that you want the Co-administrator to access.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-gb\/azure\/billing\/media\/billing-add-change-azure-subscription-administrator\/addcoadmin2.png\" alt=\"Screenshot that shows a subscription selected \" data-linktype=\"relative-path\"><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<p><span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"8bd4ac20d59c62f919cdc9e741024353:0\">+ <\/a><\/span><\/p>\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"ac41fc2c50fd2e7819ceb963f1524b89:0\">The following email address can be added as a Co-Administrator:<span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"ac41fc2c50fd2e7819ceb963f1524b89:0\">+ <\/a><\/span><\/p>\n<ul class=\"lf-text-block lf-block\" data-lf-anchor-id=\"8241293e459d24a87eaedf43fba16f2b:0\">\n<li style=\"list-style-type: none;\">\n<ul class=\"lf-text-block lf-block\" data-lf-anchor-id=\"8241293e459d24a87eaedf43fba16f2b:0\">\n<li><strong>Microsoft Account<\/strong> (formerly Windows Live ID)<br \/>\nYou can use a Microsoft Account to sign in to all consumer-oriented Microsoft products and cloud services, such as Outlook (Hotmail), Skype (MSN), OneDrive, Windows Phone, and Xbox LIVE.<\/li>\n<li><strong>Organizational account<\/strong><br \/>\nAn organizational account is an account that is created under Azure Active Directory. The organizational account address has this format:user@&lt;your domain&gt;.onmicrosoft.com<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"8241293e459d24a87eaedf43fba16f2b:0\">+ <\/a><\/span><\/p>\n<h2 id=\"change-service-administrator-for-a-subscription\">Change Service Administrator for a subscription<\/h2>\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"a008692e8a5967e93bc3f143556244c7:0\">Only the Account Administrator can change the Service Administrator for a subscription.<span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"a008692e8a5967e93bc3f143556244c7:0\">+ <\/a><\/span><\/p>\n<ol class=\"lf-text-block lf-block\" data-lf-anchor-id=\"aa8dac0fda996bfb39c9e443554145d7:0\">\n<li style=\"list-style-type: none;\">\n<ol class=\"lf-text-block lf-block\" data-lf-anchor-id=\"aa8dac0fda996bfb39c9e443554145d7:0\">\n<li>Sign in to <a href=\"https:\/\/account.windowsazure.com\/subscriptions\" data-linktype=\"external\">Azure Account Center<\/a> by using the Account Administrator.<\/li>\n<li>Select the subscription you want to change.<\/li>\n<li>On the right side, click <strong>Edit subscription<\/strong> details.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-gb\/azure\/billing\/media\/billing-add-change-azure-subscription-administrator\/editsub.png\" alt=\"editsub\" data-linktype=\"relative-path\"><\/li>\n<li>In the <strong>SERVICE ADMINISTRATOR<\/strong> box, enter the email address of the new Service Administrator.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-gb\/azure\/billing\/media\/billing-add-change-azure-subscription-administrator\/changesa.png\" alt=\"changeSA\" data-linktype=\"relative-path\"><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<p><span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"aa8dac0fda996bfb39c9e443554145d7:0\">+ <\/a><\/span><\/p>\n<h2 id=\"change-the-account-administrator\">Change the Account Administrator<\/h2>\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"83a8416f67d12cbd7dafbdc7cfe34433:0\">To transfer ownership of the Azure account to another account, see <a href=\"https:\/\/docs.microsoft.com\/en-gb\/azure\/billing\/billing-subscription-transfer\" data-linktype=\"relative-path\">Transferring Ownership of an Azure subscription<\/a>.<span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"83a8416f67d12cbd7dafbdc7cfe34433:0\">+ <\/a><\/span><\/p>\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"2308ac2e43fb71b919aff926a3616a39:0\">We strongly recommend that you don&#8217;t delete or rename the Account Administrator&#8217;s email address. You may see unexpected and undesirable behavior with the Azure account. You may not be able sign-in to Azure with that account, make changes to the account, or manage resources with that account. <span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"2308ac2e43fb71b919aff926a3616a39:0\">+ <\/a><\/span><\/p>\n<h2 id=\"check-the-account-administrator-of-the-subscription\">Check the Account Administrator of the subscription<\/h2>\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"c284692e93ba25a127ccbd56d22843f1:0\">If you&#8217;re not sure who the account administrator is for your subscription, use the following steps to find out.<span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"c284692e93ba25a127ccbd56d22843f1:0\">+ <\/a><\/span><\/p>\n<ol class=\"lf-text-block lf-block\" data-lf-anchor-id=\"8f80002fd79966ad39c9c047c5214b57:0\">\n<li style=\"list-style-type: none;\">\n<ol class=\"lf-text-block lf-block\" data-lf-anchor-id=\"8f80002fd79966ad39c9c047c5214b57:0\">\n<li>Sign in to the <a href=\"https:\/\/portal.azure.com\/\" data-linktype=\"external\">Azure portal<\/a>.<\/li>\n<li>On the Hub menu, select <strong>Subscription<\/strong>.<\/li>\n<li>Select the subscription you want to check, and then look under <strong>Settings<\/strong>.<\/li>\n<li>Select <strong>Properties<\/strong>. The account administrator of the subscription is displayed in the <strong>Account Admin<\/strong> box.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<p><span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"8f80002fd79966ad39c9c047c5214b57:0\">+ <\/a><\/span><\/p>\n<h2 id=\"types-of-azure-admin-accounts\">Types of Azure admin accounts<\/h2>\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"2b44e82686f969f03b9ce84351836054:0\">Account Administrator, Service Administrator, and Co-administrator are the three kinds of administrator roles in Microsoft Azure. The following table describes the difference between these three administrative roles.<span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"2b44e82686f969f03b9ce84351836054:0\">+ <\/a><\/span><\/p>\n<table>\n<thead>\n<tr>\n<th>Administrative role<\/th>\n<th>Limit<\/th>\n<th>Description<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Account Administrator (AA)<\/td>\n<td>1 per Azure account<\/td>\n<td>This is the person who signed up for or bought Azure subscriptions, and is authorized to access the <a href=\"https:\/\/account.windowsazure.com\/Home\/Index\" data-linktype=\"external\">Account Center<\/a> and perform various management tasks. These include being able to create subscriptions, cancel subscriptions, change the billing for a subscription, and change the Service Administrator.<\/td>\n<\/tr>\n<tr>\n<td>Service Administrator (SA)<\/td>\n<td>1 per Azure subscription<\/td>\n<td>This role is authorized to manage services in the <a href=\"https:\/\/portal.azure.com\/\" data-linktype=\"external\">Azure portal<\/a>. By default, for a new subscription, the Account Administrator is also the Service Administrator.<\/td>\n<\/tr>\n<tr>\n<td>Co-administrator (CA) in the <a href=\"https:\/\/manage.windowsazure.com\/\" data-linktype=\"external\">Azure classic portal<\/a><\/td>\n<td>200 per subscription<\/td>\n<td>This role has the same access privileges as the Service Administrator, but can\u2019t change the association of subscriptions to Azure directories.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"lf-text-block lf-block\" data-lf-anchor-id=\"8f06e028c5bf20715cc31eff01626d28:0\">Azure Active Directory Role-based Access Control (RBAC) allows users to be added to multiple roles. For more information, see <a href=\"https:\/\/docs.microsoft.com\/en-gb\/azure\/active-directory\/role-based-access-control-configure\" data-linktype=\"relative-path\">Azure Active Directory Role-based Access Control<\/a>.<span class=\"lf-thread-btn\"><a class=\"fycon-action-view\" tabindex=\"0\" aria-label=\"Write a Sidenote\" data-lf-anchor-id=\"8f06e028c5bf20715cc31eff01626d28:0\">+ <\/a><\/span><\/p>\n<h2 id=\"limitations-and-restrictions-for-admin-accounts\">Limitations and restrictions for admin accounts<\/h2>\n<ul class=\"lf-text-block lf-block\" data-lf-anchor-id=\"222cae3e4739eff017cdf547dbe26fbb:0\">\n<li>Each subscription is associated with an Azure AD directory (also known as the Default Directory). To find the Default Directory the subscription is associated with, go to the <a href=\"https:\/\/manage.windowsazure.com\/\" data-linktype=\"external\">Azure classic portal<\/a>, select <strong>Settings<\/strong> &gt; <strong>Subscriptions<\/strong>. Check the subscription ID to find the Default Directory.<\/li>\n<li>If you are signed in with a Microsoft Account, you can only add other Microsoft Accounts or users within the Default Directory as Co-Administrator.<\/li>\n<li>If you are signed in with an organizational account, you can add other organizational accounts in your organization as Co-Administrator. For example, abby@contoso.com can add bob@contoso.com as Service Administrator or Co-Administrator, but can&#8217;t add john@notcontoso.com unless john@notcontoso.com is in Default Directory. Users signed in with organizational accounts can continue to add Microsoft Account users as Service Administrator or Co-Administrator.<\/li>\n<li>Now that it is possible to sign in to Azure with an organizational account, here are the changes to Service Administrator and Co-administrator account requirements:<br \/>\n<table>\n<thead>\n<tr>\n<th>Sign in Method<\/th>\n<th>Add Microsoft Account or users within Default Directory as CA or SA?<\/th>\n<th>Add organizational account in the same organization as CA or SA?<\/th>\n<th>Add organizational account in different organization as CA or SA?<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Microsoft Account<\/td>\n<td>Yes<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<\/tr>\n<tr>\n<td>Organizational Account<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>No<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>Photo by&nbsp;<a href=\"https:\/\/unsplash.com\/photos\/1O3Z4ZsM8VM?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText\">rawpixel<\/a>&nbsp;on&nbsp;<a href=\"https:\/\/unsplash.com\/search\/photos\/adding?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText\">Unsplash<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>You can change the Azure administrator that manages your Azure subscription or manages the Azure services used in your subscription. To view Azure billing information and manage subscriptions, you must sign in to the Account Center as the Account Administrator. + Add an admin for a subscription You can add an Azure administrator in the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":3362,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[12],"tags":[],"class_list":["post-83","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/83","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=83"}],"version-history":[{"count":3,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/83\/revisions"}],"predecessor-version":[{"id":3363,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/83\/revisions\/3363"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/media\/3362"}],"wp:attachment":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=83"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=83"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=83"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}