We have a Visual Studio Enterprise Subscription – MPN subscription. Therefore, we can create several Azure accounts under the same subscription in the same tenet. So, Basically we have an one root Azure account and several Azure accounts which are inherited to the root Azure account In my environment, I have configured Azure ADDS under my root Azure account. I have several VMs in another Azure account under the same subscription as I described above. My requirement is to connect those Azure VMs to the Azure ADDS in the root Azure account. Is there any way to do it? I know how to do it when Azure ADDS and Azure VMs in the same account.
As you aware Azure Active Directory Domain services integrates with your existing Azure AD tenant. This integration lets users sign in to service and applications connected to the managed domain using their existing credentials. Joining the VM hosted in another Tenant is not applicable . You have mentioned different Azure Account if it is a different Tenant then there is no possibility at this time.
Related
When installing an azure data gateway, the installer requires an email address of an organizational account, which it then signs into azure with.
For testing, i have been using my own account, but for a live system, should a dedicated "service" account be created for the data gateway?
During gateway installation, you sign in with your Azure account, which links your gateway installation to your Azure account and only that account. Later, in the Azure portal, you must use the same Azure account and Azure AD tenant when you create an Azure gateway resource that registers and claims your gateway installation. In Azure Logic Apps, on-premises triggers and actions then use the gateway resource for connecting to on-premises data sources.
You need to sign in with either a work account or school account, also known as an organization account, which looks like username#contoso.com. You can't use Azure B2B (guest) accounts or personal Microsoft accounts, such as #hotmail.com or #outlook.com.
For more details, you could refer to this article.
I started learning Microsoft Azure but I'm stuck
Can anyone tell me what is the difference between Microsoft account vs tenant vs Subscription in detail?
When you say "Microsoft account", this usually refers to personal Microsoft accounts (outlook.com/live.com/hotmail.com).
But it could also refer to organizational Azure Active Directory accounts.
They are both kinds of user accounts, both types can exist as members in an Azure Active Directory "tenant".
This tenant is basically an instance of Azure AD for your users, in your control.
When you log in to Azure, you are logging in to Azure AD.
An Azure subscription is where you deploy your services, create resources like databases etc.
A subscription is always linked to an Azure AD tenant.
The users in this linked tenant can be given roles in the subscription to access/modify resources.
If anyone wants access to the subscription, they need to be added to the Azure AD tenant first.
This can be done by creating them an account there, or by inviting them by their email as a "guest".
microsoft account: the one used to log in
tenant: your azure active directory (usually the default is [account].onmicrosoft.com
subscription: your microsoft azure subscription, the one used to create services/ deploy your applications
I have created a native application in an Azure AD in Azure General region. The application has been granted appropriate permissions (Sign in on user's behalf, execute Service Management API requests etc.). Using this application, I am able to connect to any Azure Subscription in Azure General region using this application.
However when I try to connect to an Azure Subscription in Azure China, after successful login, I am getting the following error:
AADSTS70001: Application with identifier '01234567-890a-bcde-ffff-fcc63fc150ea' was not
found in the directory 'xxx.yyy.onmschina.cn'.
So my questions are:
Is it possible to connect to an Azure Subscription in Azure China (or for that matter to any Azure Subscription in Azure Sovereign Cloud like Germany etc.) using an application created in Azure General region?
Or do I need to create a separate application for each Azure Sovereign region in an Azure AD in that region?
If I indeed need to create a separate application (i.e. answer is yes to above question), is it possible to create an Azure AD tenant in these Sovereign regions without having an Azure Subscription there?
I believe the answer to the last question is yes considering Azure AD and Azure Subscription are two different things, yet I would very much like to get a confirmation on the same.
No,
it is NOT possible to connect Azure "General" with any sovereign clouds - these are Azure US Government, Azure China, Azure Germany. All these clouds are completely separate deployments with their own Azure AD. You cannot use B2B inter clouds, you cannot use your multi-tenant applications across clouds.
For that case you have to have a subscription in every cloud you would like to support and separate application registration, and separate instructions for your users. Check for example how Azure CLI is handling this. You are always only connected to one cloud with cloud's specific account.
In Azure Germany you can create an Azure AD tenant - just create a free trial subscription and you will also get a tenant. For China and US Gov will be hard - they both have very strict requirements who can create subscriptions there.
Can any Azure Active Directory gurus suggest the best answer to the following...
Currently a very large enterprise already is using Azure AD syncing onsight ADDS with Azure AD (Enterprise Azure AD/ADDS).
Is the best solution to create a new Azure AD Resource to keep seperation of concerns and to ensure that users from 1 Azure AD resource has no way of of accessing the other Azure AD resource (Enterprise Azure AD/ADDS) and is there any extra cost with create 1 to n... (except for premium licenses, which we already pay for)
Does 1 Azure subscription cover 1 to n.... Azure Active Directory Resources?
We want the new Azure AD to only contain out side guests aka #gmail, #yahoo, but this is all B2B.
---1 Overall Azure Tenant
|
----+ (1) Azure AD Enterprise Synce with on premise ADDS (Office 365 and a
lot more) (Currently Exists)
|
----+ (2) Azure AD Contractors with access to specific applications that are
configured
If you have an Azure Subscription you can have multiple Azure AD resources (No Extra Cost), as many as you want. This allows for different Global Administrators to manage different Azure AD resources such as Users, Guests, Apps, Proxy connectors.
However, this does go without saying that you still have to pay for the Premium licenses if needed in each AD Azure Resource should you need them.
https://azure.microsoft.com/en-us/pricing/details/active-directory/
I've created some Microsoft Live accounts for managing my Azure subscriptions (I've got five). I can log in using, for example, joe#mycompany.com and manage my web services using the public portal. I think I've got the hang of Azure Active Directory and the Domain Services that go along with it. So now I'm wondering, can I associate my domain ('mycompany.com') with an Azure Active Directory in my corporate portal, add my user 'joe' to it, and use 'joe#mycompany.com' to sign into the portal? That is, will the Azure Portals use Azure Active Directory for logins?
The Azure Portal allows users to sign in with both Azure AD Accounts AND Microsoft accounts (aka MSAs, LiveIDs, #outlook.com).
If you associate your domain with an Azure AD tenant, you'll be able to log in to the Azure portal with your Azure AD account.
It is important to note that if you have a joe#mycompany.com Microsoft account and a joe#mycompany.com Azure AD account (which you get by adding the mycompany.com domain to an Azure AD tenant and then creating joe#mycompany.com that tenant), you effectively have tow DIFFERENT ACCOUNTS. When you type in joe#mycompany.com, you'll see a prompt like this one:
You'll have to make sure you pick the right one since your existing Azure subscriptions will be associated with your MSA and any new ones you create with your Azure AD account will, by default, not be accessible to your MSA.
Your best bet is to setup an Azure AD tenant, migrate your Azure subscriptions from your MSA to your Azure AD tenant by transfering ownership of the subscription and ensure all new subscriptions are created with Azure AD accounts (and not MSAs). At that point, you can always pick Organizational account and not have to worry about which which Azure subscription is linked to which account.
Other relevant info:
Comprehensive explanation of MSAs, Azure AD and Azure Subscriptions
Creating an Azure subscription using an Azure AD tenant