Make Azure learning credits visible in the coffee shop domain

The Microsoft Accounts mess can make it hard to use your Azure credits that come bundled with MSDN/VSOL. You can end up with two accounts with the same name, one work/school in your corporate domain and one personal  Microsoft ID outside the corporate domain.  Enterprise users run into this when they want to learn in Azure using their Corporate MSDN Azure credits.

Both accounts have the same email domain which means they both have corporate accessibility zone restrictions even though the two accounts are not connected in any way and have no way of seeing each other's resources.

We can share this subscription with your personal, non-corp domain, account or create an ID that only exists in the ID that is tied to the subscription.  This lets you learn Azure while sitting at home or the coffee shop. 

This blog assumes you are allowed to use your Azure credits for your education from personal gear.  If not, then stop here.

Video Discussion

Initial State

We usually start with the bottom half of this diagram where we have a restricted, secure corporate account that gives you access to corporate Azure resources.  Then we add in an MSDN subscription which has its own Azure credits.  This usually gets bound to the same user name as your enterprise account.  It looks the same but is actually in a different domain.  The Microsoft ID is the Account Admin for the MSDN subscription. Basically, we're going to start this using whichever account is the Account Admin for our new subscription.

Setting up your MSDN Subscription

The first step is to create an Azure tenant, usually in some domain like <something>.onmicrosoft.com.  We make our Microsoft ID be the owner of the Azure tenant.  Then we tell the MSDN Subscription that the new Active Directory tenant is its directory.

Add your users

Now we add other Users to the directory. They should either be locally domain IDs or external IDs. Those IDs will be able to log in from other locations without confusing the zone protections.

All together now

This diagram shows how it could look if you add an external ID to the MSDN Azure AD tenant. The external ID will be registered as a user in its own Domain (tenants) and it will be a guest in the new AD tenant bound to our new Azure/MSDN subscription.

Steps - Too Brief

Create a domain/tenant, own it, move the subscription

1. Log in to Azure Portal using the account that is the Subscription owner
2. Create an AD tenant if you need one
1. Azure Active Directory
2. Click on Manage Tenants
3. Click on Create
4. Enter the Organization Name and Domain Name 
   
1. The example will use magic and <something-unique>.onmicrosoft.com
5. Make it happen
6. Wait a while for the tenant creation process to complete
3. Make sure you are still in the old AD tenant.  If not, change to your new tenant.
1. Click on your login name/picture in the upper right.
2. Click on switch directories.
3. Select your old directory, not the one just created.
4. Change the Directory your subscription is bound to
1. Go to the Subscriptions blade
2. Select Change Directory --> in the panel
3. Select the newly created directory as the tenant.
4. Move the subscription
5. Wait 10 minutes
5. Change to the new Directory using Change Directory in the profile dropdown
6. Enable access to the AD Tenant billing information
1. Navigate to Azure AD
2. Click on Properties
3. Enable Access management for Azure resources
7. Give our ID owner role for the subscription.
1. Navigate to the subscription
2. Select Access Control (IAM)
3. Select the Role Assignments tab
4. You should see yourself as the User Access Administrator. This is not an Owner. 
5. Add an Owner role assignment 
1. Click on Add --> Role Assignment
2. Select Owner
3. Click Next
4. Select the user in Assign access to
5. Click Next
6. Click on Review and Assign  and make it happen
8. Verify you can create something like a Resource Group

Create a new developer user in AD 

We can either create a new user in our tenant/domain or we can invite an existing Microsoft ID into our domain.

1. Navigate to your Azure Active Directory.
2. Click on Users on the left site
3. You should only see the account you are currently logged in as, assuming this is the first time adding a user.
4. Click on New User
5. Create a new account or invite an existing user.
1. If you create a new user, not invite, then it will end up being something like <user>@<tenant domain>.  Record the password.  You will be prompted to change it the first time you log in.
2. If you invite an external user then you have to click on the invitation email link to activate.
3. External users are guest users with permission limits.   You can change the state of the user from guest to member after they are activated.
6. Verify the new directory user can log in via the Azure Portal on another machine or in another browser.

Give the new user AD permissions

Make this user a power user on Active Directory if are comfortable with the security implications. This may not be needed.

1. Make the user a Global Administrator.
1. Navigate to Azure AD
2. Click on Users and then our new user
3. Select Assigned Roles which show the roles on the Azure Directory itself
4. Click on Add Assignments
5. Select the Global Administrator role and the new user
6. Click through and make it happen

Give the new user permissions on the subscription

Our new user needs permission on the subscription

1. Navigate to the subscription Subscriptions --> <our subscription>
2. Select IAM
3. Click on Add --> Co-administrator
4. Select the new user.
5. Click on Add
6. Click on Add --> Owner
7. Select our new user
8. Review and Assign
9. You should see two owners, the current one and the newly created one.

Verify the permissions

1. Navigate to Active Directory
2. Click on Users
3. Click on Azure Role Assignments
4. You should see the two permissions for the new users, User Access Administration and Owner

Verify this all works

1. Log in to the added ID in a different browser.
2. Navigate to Active Directory
3. Click on Users
4. Verify permissions

Party like its 1999. Or Party like a rockstar depending on your generation

Conceived 2018 01

Posted 2022 01