Assigned Azure Custom Vision role to user but unable to access resource.
Errors shown:
Subdomain does not map to a resource.
Please check if desired resource exists in subscription.
image
As per this official documentation,
Azure Cognitive Services use custom subdomain names for each resource
created through the Azure portal, Azure Cloud Shell, or Azure CLI.
Unlike regional endpoints, which were common for all customers in a
specific Azure region, custom subdomain names are unique to the
resource. Custom subdomain names are required to enable features like
Azure Active Directory (Azure AD) for authentication.
So, I suggest you to first create a Custom subdomain name for the resource and then use RBAC user to access it.
Also, make sure the user has either Owner or atleast Contributor permission for that resource.
Follow below instructions to migrate an existing resource to leverage custom subdomain names:
Sign in to the Azure portal and locate the Cognitive Services resource that you'd like to add a custom subdomain name to.
In the Overview blade, locate and select Generate Custom Domain Name.
This opens a panel with instructions to create a unique custom subdomain for your resource.
Related
Currently i am trying to dig deeper into the organizational/entity structure of ms azure. All I find online in discussions and official ms documentation only shows parts of the bigger picture but never the underlying relationships between them.
I try to formulate statements which I ask you to correct in case they are wrong:
I log in to the azure portal using an email adress witch is called account
In the azure portal I am acting in the context of a directory
The account i use to log in is associated with an identity in the directory
A directory belongs to a tenant
Signing up for MS Azure using my Microsoft Account will create a Tenant
A Subscription I create is assoiciated with but not created/stored within a directory (not with a tenant)
A Subscription I create is associated with the Account I am currently logged in, called Azure Account
A Management Group will be created within the directory per default, called Root Management Group
When no other Management Group is created, all Subscriptions I create are associated with this Root Management Group
Any thoughts on that?
Thanks TGY for your question. The terms "tenant" and "directory" are for the most part interchangeable and are used in Azure.
A tenant is an instance of an Azure Active Directory. The tenant is an account in Azure that comes with a subdomain and an associated Azure Active Directory. In order to use an Azure Active Directory you need to become a tenant within the system. So a tenant is basically securing a .onmicrosoft.com subdomain. At that point you would have one account registered in your Azure AD.
An Azure subscription is a logical container used to provision resources in Azure.It serves as a single billing unit for Azure resources in that services used in Azure are billed to a subscription. An Azure subscription is linked to a single account, but you can add multiple subscriptions to the same directory.
Please see this DOC if it helps you.
Root Management>>Management Group>>Subscription>>Resources Group>>Resources. So for IAM(Identity & Access Management) purpose, management Group is higher level than Subscription. Subscription is higher than Resource Group and Resource Group is higher than a particular resource level.
Please find below Architectural structure for more understanding and pictorial representation --
Is it possible to restrict user access to view the custom domains added to Azure AD please? I have tried to create a custom role in Azure RBAC with scope of "/" but this is not permitted.
Thanks
Matt
No you cannot restrict user to view specific custom domain at azure active directory at this moment. Azure active directory does not have this feature.
You can use an allow list or a deny list to allow or block invitations to users from specific organizations. You could take a look here
You also can restrict your application over your resource group and user.
Note: To know more about the scope the RBAC you could refer here
I want to publish a web application to a Azure Web App and enable Organizational Authentication during the process. The wizard offers the following options:
I've added two custom domains to our Office 365 subscription that also show up in the corresponding Azure AD tenant.
Instead of using the default domain mycompany.onmicrosoft.com I want to use one of those custom domains so that this domain is shown to the user on various web pages that handle authentication and consent. I was able to use the custom domain without any problem when configuring Azure AD authentication for the web project.
When using the custom domain in the wizard (field domain in the screenshot), I first need to enter my O365 credentials. Shortly after, the following error is displayed:
Provisioning the destination end point failed with the error:
'The user account 'x#y.z' doesn't have the required permissions to access the domain 'y.z'.'
If you don't intend to enable Orgnizational Authentication during
publish, please turn that option off in the publish dialog.
The Directory Role of the account is Global Administrator and I've already registered multiple apps using this account. So I don't think that this has anything to do with permissions.
Do I have to use the *.onmicrosoft.com domain or can I solve this in a different way?
As a sidenote (just if this is makes a difference): the web app resides in a Azure subscription that belongs to my Microsoft account whereas the O365 Azure AD is administered by my work account and does not belong to a subscription. Of course, not the most straightforward way, but I guess pretty common for Microsoft partners as the Azure benefits can only be actived on a Microsoft account even if the partner already has a O365 subscription.
To use the custom domain for the organization authentication we need to enable it as the primary domain.
You can check it from the old Azure portal here like figure below:
Update( change the primary domain in new Azure portal)
locate Azure Active Directory->Domain names->select the domain which want to set as primary domain like figure below:
When I select an IAM menu (Identity + Acces Management) I see a list of user accounts extracted from my Azure AD
But I have several AD.From what criteria Azure select an AD rather another one?
Hi assuming your question is that you have multiple Azure Active Directories, rather than multiple on-prem ADs that you need to sync - then via the preview management blades in the new portal can you change which Direcotry they list via the icon on the top right which shows your logged in user. From there simply select the Directory you wish to manage.
It is only able to grant the access to the users in the Azure Active Directory which the Azure subscription trust. It is not able to switch the Azure Active Directory to grant the access.
Each Azure subscription is associated with one Azure Active Directory (AD) directory. Users, groups, and applications from that directory can manage resources in the Azure subscription. Assign these access rights using the Azure portal, Azure command-line tools, and Azure Management APIs.
Grant access by assigning the appropriate RBAC role to users, groups, and applications at a certain scope. The scope of a role assignment can be a subscription, a resource group, or a single resource. A role assigned at a parent scope also grants access to the children contained within it. For example, a user with access to a resource group can manage all the resources it contains, like websites, virtual machines, and subnets.
The RBAC role that you assign dictates what resources the user, group, or application can manage within that scope.
Here are some helpful articles about Role-based access control and Azure subscription:
How Azure subscriptions are associated with Azure Active Directory
Get started with access management in the Azure portal
Use role assignments to manage access to your Azure subscription resources
I have an VM running in Azure which I would like the client to be able to turn on/off easily. I tought this would be simple; just a PS-script that performs an startup/shutdown/dealloc. But it seems I can't generate a "Azure Publish Settings"-file that only gives access to that VM? At the moment it seems I can only control this at the subscription level?
The Azure Publish Settings file basically contains the access information for an entire Azure subscription. It does not specify access to a specific resource (e.g. VM) but to all resources inside of a subscription.
To limit access to a subset of resources in Azure, you should be looking at the new role-based access (RBAC) functionality, which is available in the Azure preview portal and the latest Azure PowerShell cmdlets.
How it works is that you create an Azure resource group, to which you can assign roles with specific rights, and to this role you can then assign individual users.
Check the following Azure documentation link for details on how to do this.