I've set up Azure AD authentication on a existing web app and that works ok.
I then want to add "Users in partner companies" via CSV upload. But the account I use to administer Azure is my company account so the option is not available.
So I then created a APPNAME.onmicrosoft.com account.
But when I log in to the portal with that, it's not linked to any subscriptions so obviously it can't add any users to the AD.
And I can't add the user to the subscription as they are not recognised.
I appreciate I'm probably missing/misunderstanding something fundamental but can anyone explain what I need to do to be able to enable B2B collaboration?
If you look at your list of subscriptions is APPNAME.onmicrosoft.com the default directory for any subscription? You currently can't do B2B invites unless it is the default directory for some Azure subscription and unless you pick APPNAME.onmicrosoft.com from the drop down in the top right of the portal. We have had to create a new empty Azure subscription with APPNAME.onmicrosoft.com as the default directory and make the B2B a subscription admin.
Now in order to switch the default directory of the subscription my recollection is that you have to be logged in with a Microsoft account (LiveID) rather than an organizational account.
Related
I was logged in to my AzureDevops account using my hotmail account.I then went to Organization Settings and then connected my Org to Azure AD.
After i logged out and logged in back again with the same account, i don't see anymore my projects which i was working on. I have disconnected my Azure AD and also tried switching directories but i am no longer able to see that particular organization anymore.
Any idea how to fix this or why this happened
Please check below points :
Try logging on to https://.visualstudio.com to see you can see the organization and projects, as stated in this.
Check Troubleshoot connecting to a project
You may not able to signin or access your organization unless your work or school account has the same email address as your Microsoft account.
Although you can add new work accounts to your organization, they're
treated as new users.
If you want to access all your work, including its history, you must
use the same sign-in addresses that you used before your organization
was connected to your Azure AD.
For that Add your Microsoft account as a member to your Azure AD Or
ask the owner of the organization who has proper permissions to map
any disconnected members to their Azure AD identities Or invite them
as guests into the Azure AD.
Invited user should use corresponding account, work/school account
for AAD based, personal account for the other.
So basically the user who makes the connection must confirm the following statements are true.
User exists in Azure AD as a member. If the user is an Azure AD guest, rather than member
User must have project collection administrator or owner of the organization
User must also have Azure Service Administrator or Coadministrator permissions for the Azure subscription that's linked to your organization in Azure DevOps.
User isn't using the Microsoft account identity that matches the Azure AD identity. For example, if the Microsoft account that users are currently using is jamalhartnett#fabrikam.com, the Azure AD identity they'll use after connecting is also jamalhartnett#fabrikam.com. Use a single identity that spans both applications, rather than two separate identities using the same email.
Add your work account as an administrator in your Azure DevOps organization
The AAD tenant should be same as the DevOps tenant to connect & Transfer the ownership of the organization to your work account.
Please see if you have followed the Prerequisites to Connect organization to Azure Active Directory
FAQ: to be refered
why dont i see my organization in the azure portal
why do i have to choose between a work or school account and my personal account
what if we cant use the same sign in addresses
Note: No other user than the owner of the organization will be able to see the organization under the “Azure DevOps organizations”
service in the Azure portal. Also, Azure DevOps does not support
multiple owners, like Azure services that support Role Based Access
Control (RBAC) do. An Azure DevOps organization will only have a
single owner at a time :reference
Please try to access https://aex.dev.azure.com/ and change domain to see if your organization is present in the list.
Or
You may need to open a support case on the Developer Community to help you out or raise a support request through azure portal.
References:
Lost organization after disconnecting it from Azure Active Directory-Stack Overflow
What not to do when Connecting Azure DevOps to
AzureAD |Josh Corrick |
Restore project - Azure DevOps Services | Microsoft Docs
I have a MSDN subscription from my work account, when I login, I can see there is already an azure active directory associated (which is company's one I have read only access). I need to provision another AAD directory for development purpose, however when I 'switch' the directory I can see it has no Azure subscription, which I need the credit for.
Question, how to change this behavior, I am thinking either a) change the default directory for my msdn subscription or b) transfer the subscription over to the new directory?
Please help!
Based on the current implementation, an Azure Subscription only trusts users from a single Azure AD.
From How Azure subscriptions are associated with Azure Active Directory:
Every Azure subscription has a trust relationship with an Azure AD
instance. This means that it trusts that directory to authenticate
users, services, and devices. Multiple subscriptions can trust the
same directory, but a subscription trusts only one directory. You can
see which directory is trusted by your subscription under the Settings
tab. You can edit the subscription settings to change which directory
it trusts.
To answer your questions specifically, please see this link on how you can change the trust relationship between an Azure AD and an Azure Subscription.
I am trying out ad-b2c and boy even the first step is turning out to be extremely frustrating. Anyway here's my problem:
I have an existing subscription with a default directory which has its own mydefaultdirectory.onmicrosoft.com domain
According to instructions here: I should be able to create an ad-b2c tenant, and then go into the portal B2C features blade.
I created the tenant, which included me creating a custom ad-b2c directory. I had to choose another domain such as myadb2ctest.onmicrosoft.com.
I go to the portal under b2c blade, but now I have no subscription. This is because now I am logged in to the myadb2ctest directory rather than mydefaultdirectory which has my subscription.
I DO NOT want to create a new subscription. I just want this directory associated with my already existing subscription so I can try this thing out.
An Azure AD (and B2C) is a higher level object than a subscription in the portal user interface. That's why you lose your subscription view when selecting B2C.
Internally this will be linked to your subscription, otherwise Microsoft couldn't send you a bill. if you go to the B2C dashboard, there is text containing the linked subscription:
Subscription status
If there is no subscription linked, there is a warning in the B2C Dashboard:
No Subscription linked to this B2C tenant or the Subscription needs your attention.
And then you will need to take these actions:
This B2C tenant must be linked to an active Azure subscription for communication, support and billing.
If your Subscription status is No Subscription, please link this B2C tenant to an Azure subscription,
Switch Directories to the location of your target Azure subscription
Under Marketplace, search for and select 'B2C'
Select Create to link this B2C Tenant to a subscription
Unfortunately today B2C features cannot be turned on in an existing tenant.
https://learn.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-faqs
Please make your B2C directory a default directory for an Azure Subscription. You could think of a B2C directory as a normal AAD during this process.
This process of switching the default directory can only be done through Azure Classic Portal using Service Admin (live account ONLY) for the subscription.
You could refer this article for further steps:
https://ballance.in/default-directory-of-an-azure-subscription/
I don't really understand why on this case. My company has an azure subscription for development/testing environment.
At the beginning I am co-admin on this subscription with my Microsoft account. Now I need to manage applications under Azure AD of that subscription. So my Microsoft Account is leveraged to Global Admin of this Azure AD.
But even my MS account is leveraged to Global Admin, I cannot see or have access to Azure AD.
After searching around and based on this article:
https://blogs.msdn.microsoft.com/dstfs/2015/12/23/issues-with-azure-active-directory-guest-users-in-aad-backed-visual-studio-team-services-accounts/
I am GUEST (user type) on Azure AD, so even I am global admin, I still cannot have access to this Azure AD.
From the link, this happens because:
One way you can become an AAD GUEST is when you are made a co-admin on an Azure subscription before being added to the AAD associated with it
It can be fixed by using powershell like #CtrlDo's answer. But you have to create an global admin with work/school account since this approach does not work with Microsoft account:
PowerShell - Connecting to Azure Active Directory using Microsoft Account
We have another approach which can be done in the UI that we think it's simpler:
Remove my account out of co-admins of subscription.
Remove my account out of Azure AD.
Add my account back to Azure AD as Global Admin.
Add my account back to be co-admin on subscription.
That does work perfectly
When you were added to the AAD, your user type might have been set to "guest"
See https://azure.microsoft.com/en-us/documentation/articles/active-directory-create-users/ for more information.
See https://blogs.msdn.microsoft.com/dstfs/2015/12/23/issues-with-azure-active-directory-guest-users-in-aad-backed-visual-studio-team-services-accounts/ for an older post on how to view the issue in powershell and fix it.
I am unable to view any services in my azure portal. A couple of days back everything was visible.
I think there's some permissions issue. I am logging as Global Admin on the portal.
[UPDATE]: I was trying to publish a web application from visual studio to my azure account and when I select my account, it says "There are no Azure subscriptions associated with this account". Is it that my account is suspended or deactivated or so?
You are signed in to the classic portal with an AAD subscription. These subscriptions don't support using other services. You might be signed in to the wrong directory. Use the "Subscriptions" menu at the top to switch. If you don't have that, you could also be signed in to the wrong account. Some people have used "work/school" (AAD) email addresses to sign up for a "personal" (Microsoft Account) account. If that happens, you'll see a prompt to pick one of the two when you sign in. If you don't see your subscription, it may be assigned to the personal/MSA account. You can grant access to the other one to avoid this.