This problem may stem from the dependency on MS accounts for MSDN instead of work accounts, but maybe some one has found a solution?
I use the same email address for both my MS and Work Accounts.
Our Company Subscriptions seems to be linked to our MS Accounts, as does our VSTS accounts. I can sign into Azure Portals using both MS and Work Account. I want to be able to deploy do our company subscription from VSTS.
When I sign into Azure, using my work account, I can see our Azure AD. I am a global admin and can make changes, etc. This is not visible when I sign in using the MS account. It tells me I don't not have access, which I can understand.
In VSTS, I have linked my MS Account to my work account. But I cant access some of the projects # {whatever}.visualstudio.com VSTS sites with my work account, I must use my MS account.
The main problem is when I try to set up a build and deploy from VSTS into the Company Azure Subscription. To achieve this I need to set up a Service Endpoitn to ARM in Azure. So I go ahead and try to do that.
It fails as it says that the account does not have the sufficient privileges needed in Azure Active Directory. Remember, AAD is only accessible when I log into my work account in the azure portal.
One last point, AAD would see my MS account as a guest account, so I thought 'hey, I will add that account to AAD as a guest and assign privileges necessary to perform the tasks I need'. But because the same email address was used for both my MS account and work account, it tells me when I try to add the guest account, that it already exists.
Is there any way around this problem? How can I associate/move all VSTS subscriptions to my work account?
When the VSTS identity you are using does not have access to the Azure subscription your trying to deploy to, the best way to do this is to create your service endpoint manually.
The steps are [here][1]. See the Azure Resource Manager service endpoint -> Manual subscription definition section. It has a few more steps, but once you create that, just use that service endpoint in your build or release definitions & your good to go.
Related
I was logged in to my AzureDevops account using my hotmail account.I then went to Organization Settings and then connected my Org to Azure AD.
After i logged out and logged in back again with the same account, i don't see anymore my projects which i was working on. I have disconnected my Azure AD and also tried switching directories but i am no longer able to see that particular organization anymore.
Any idea how to fix this or why this happened
Please check below points :
Try logging on to https://.visualstudio.com to see you can see the organization and projects, as stated in this.
Check Troubleshoot connecting to a project
You may not able to signin or access your organization unless your work or school account has the same email address as your Microsoft account.
Although you can add new work accounts to your organization, they're
treated as new users.
If you want to access all your work, including its history, you must
use the same sign-in addresses that you used before your organization
was connected to your Azure AD.
For that Add your Microsoft account as a member to your Azure AD Or
ask the owner of the organization who has proper permissions to map
any disconnected members to their Azure AD identities Or invite them
as guests into the Azure AD.
Invited user should use corresponding account, work/school account
for AAD based, personal account for the other.
So basically the user who makes the connection must confirm the following statements are true.
User exists in Azure AD as a member. If the user is an Azure AD guest, rather than member
User must have project collection administrator or owner of the organization
User must also have Azure Service Administrator or Coadministrator permissions for the Azure subscription that's linked to your organization in Azure DevOps.
User isn't using the Microsoft account identity that matches the Azure AD identity. For example, if the Microsoft account that users are currently using is jamalhartnett#fabrikam.com, the Azure AD identity they'll use after connecting is also jamalhartnett#fabrikam.com. Use a single identity that spans both applications, rather than two separate identities using the same email.
Add your work account as an administrator in your Azure DevOps organization
The AAD tenant should be same as the DevOps tenant to connect & Transfer the ownership of the organization to your work account.
Please see if you have followed the Prerequisites to Connect organization to Azure Active Directory
FAQ: to be refered
why dont i see my organization in the azure portal
why do i have to choose between a work or school account and my personal account
what if we cant use the same sign in addresses
Note: No other user than the owner of the organization will be able to see the organization under the “Azure DevOps organizations”
service in the Azure portal. Also, Azure DevOps does not support
multiple owners, like Azure services that support Role Based Access
Control (RBAC) do. An Azure DevOps organization will only have a
single owner at a time :reference
Please try to access https://aex.dev.azure.com/ and change domain to see if your organization is present in the list.
Or
You may need to open a support case on the Developer Community to help you out or raise a support request through azure portal.
References:
Lost organization after disconnecting it from Azure Active Directory-Stack Overflow
What not to do when Connecting Azure DevOps to
AzureAD |Josh Corrick |
Restore project - Azure DevOps Services | Microsoft Docs
My team already has a working Azure DevOps account. I would like to start an Azure subscription / Active Directory to begin linking our DevOps to App Services and other Azure products.
However, any time I click on a link to get started with Azure, I am met with a perplexing paradox trying to log in.
First I'm told that I can't log in because my MS account isn't found:
But if I try to "Create one!" or "get a new Microsoft account", I'm told it already exists:
I've taken out the email address being used, but I've confirmed they are the same between the two screens (I'm not even typing anything; all I'm doing is clicking "Next" on each screen).
I know that this MS account is valid. It's the same one I use to sign in with Azure DevOps and many other MS services. I'm not sure why I can't log in to the Azure set up platform. And there doesn't seem to be any kind of support options with Azure before you become a subscriber, so I thought I'd try my luck posting the issue here.
Thanks for any help!
You can connect your Azure DevOps organization to Azure Active Directory (Azure AD). Kindly checkout this document - About accessing your organization via Azure AD
Just to clarify, I hope you are an administrator on the subscription.
https://learn.microsoft.com/azure/devops/organizations/accounts/faq-azure-access?view=azure-devops
When your sign-in address is shared by your personal Microsoft account and by your work account or school account, but your selected identity doesn't have access, you can't sign in. Although both identities use the same sign-in address, they're separate: they have different profiles, security settings, and permissions.
Sign out completely from Azure DevOps by completing the following steps.
Closing your browser might not sign you out completely.
Sign in again and select your other identity.
https://learn.microsoft.com/azure/devops/organizations/accounts/faq-azure-access?view=azure-devops
To connect your organization to Azure AD.
Sign in to your organization, https://dev.azure.com/{yourorganization}).
Select gear icon > Organization settings.
Select Azure Active Directory, and then select Connect directory.
I have used the free month trial offered by Azure with a personal Microsoft account in parallel with a professional account from my company. In this professional account I have limited access to certain resources (mostly VMs, storage and that), so I don't manage neither subscriptions nor Azure AD.
After several unsuccessfull login attemps in which I was asked to provided a 6 digit code when the Microsoft Authenticator gave me an 8 digit code, I've discovered that if I do the following:
Try to sign in in azure.portal.com with my personal account (fails)
Sign in with my company account.
Then, in the upper right I see my personal account as a directory, like usenamehotmail.onmicrosoft.com. However, when trying to access Azure AD to manage that directory I am shown a message that says I have no access.
My question is, why does this happen? Can I use the same credit card and create a pay as you go subscription with another personal Microsoft account?
If you using the external account to access Azure AD like outlook.com, hotmail.com and the account from other Azure AD tenant. it will cause the Access Denied(you don't have access).
There are two ways to resolve this issue
1. Log in to Azure Portal by using the account with Global Administrator Role for Azure AD. Navigate to the User settings tab, toggle the setting Guest users permissions are limited to No.
2. Log in to Azure Portal by using the account with Global Administrator Role and navigate to the Users and Groups tab, search for the external account, and change the Directory Role to Global Administrator.
We have a O365 subscription. We have a Azure subscription.
However, the Azure subscription is originally set up with a personal(!) account with was identical to that persons O365 account.
(personal account somebody#company.nl was created and used to setup Azure while that person also had a O365 account with the name somebody#company.nl)
When I log on to Azure using henrov#company.nl I have to choose 'personal' account to log on to Azure. I do see our subscription. I understand that our Azure subscription has in fact nothing to do with our O365 subscription.
However, if I go to PowerBI in O365 and install a datagateway I need to login with my O365 account henrov#company.nl. When I the choose to install a gateway on Azure I get logged in as henrov#company.nl (School/Work account). To be followed by the message: "you have no subscriptions".
I understand what is happening. Somebody#company.nl messed up while setting up Azure. But what can I do to correct this? Would it be better to setup a complete new Azure subscription using a different adress? Or can I somehow merge the existing Azure subscription with our O365 subscription?
That's because you can actually have a Microsoft account created using your corporate e-mail, but it doesn't mean it is an organisational account like the one you have when you create an Office 365 tenant or any other service which relies on Azure AD platform.
Login to your Azure subscription using the service administrator of that subscription (the personal Microsoft account) and follow this guide to transfer the subscription to another tenant owner, that is, the global administrator of your corporate tenant.
https://learn.microsoft.com/en-us/azure/billing/billing-subscription-transfer
Finally, change the directory associated with that subscription.
https://learn.microsoft.com/en-us/azure/billing/billing-add-office-365-tenant-to-azure-subscription
You can do the latter only if you want.
I don't really understand why on this case. My company has an azure subscription for development/testing environment.
At the beginning I am co-admin on this subscription with my Microsoft account. Now I need to manage applications under Azure AD of that subscription. So my Microsoft Account is leveraged to Global Admin of this Azure AD.
But even my MS account is leveraged to Global Admin, I cannot see or have access to Azure AD.
After searching around and based on this article:
https://blogs.msdn.microsoft.com/dstfs/2015/12/23/issues-with-azure-active-directory-guest-users-in-aad-backed-visual-studio-team-services-accounts/
I am GUEST (user type) on Azure AD, so even I am global admin, I still cannot have access to this Azure AD.
From the link, this happens because:
One way you can become an AAD GUEST is when you are made a co-admin on an Azure subscription before being added to the AAD associated with it
It can be fixed by using powershell like #CtrlDo's answer. But you have to create an global admin with work/school account since this approach does not work with Microsoft account:
PowerShell - Connecting to Azure Active Directory using Microsoft Account
We have another approach which can be done in the UI that we think it's simpler:
Remove my account out of co-admins of subscription.
Remove my account out of Azure AD.
Add my account back to Azure AD as Global Admin.
Add my account back to be co-admin on subscription.
That does work perfectly
When you were added to the AAD, your user type might have been set to "guest"
See https://azure.microsoft.com/en-us/documentation/articles/active-directory-create-users/ for more information.
See https://blogs.msdn.microsoft.com/dstfs/2015/12/23/issues-with-azure-active-directory-guest-users-in-aad-backed-visual-studio-team-services-accounts/ for an older post on how to view the issue in powershell and fix it.