A couple of clients gave me access to their Azure subscriptions so that I could do work for them. The work has been completed and I asked them to remove my permission from their subscriptions.
They have done this but for some reason their subscriptions still show up in my list of available subscriptions when I click on my profile in the top right of the Azure Portal.
I can click on one of the subscriptions and switch to it, but I cannot see any of their resources, or create new ones. This confirms that I do not have permissions for that subscription anymore.
So if my access has been removed, which is it still showing up in the list of subscriptions which are available to me? Is there any way I can remove it from the list?
Thanks :)
It is not possible at the moment.
The link here shows a reply from Azure customer care.
Greetings from Microsoft Azure. I reviewed your request and would like
to mention that there is unfortunately no option to remove the
disabled subscription from the Azure portal. This is by design to
enable customer’s view the subscriptions purchased by them right from
the day the Azure account was created.
This means you are still a member of the directory (even though you are no longer an admin of anything). You can ask the administrator of the directory to remove you.
You should also upvote this suggestion: https://feedback.azure.com/forums/223579-azure-portal/suggestions/13327620-remove-old-directories
If you are a co-admin you can remove yourself by navigating to Settings->Administrators->Select->Remove from the classic portal (old)
Related
Days ago I onboarded a customer using Service Principal with an ARM template in our blob storage, then the client went to this URL:
https://portal.azure.com/#create/Microsoft.Template/uri/{Blob Url}, accepted us as their resource manager, and we could make connections and go-to resources but via PowerShell, why it doesn't show to us in our Azure Lighthouse Customers page?
I can work with the resources, make deployments, and such but doesn't show in the list, I want to know if it is because we need to be gold competency or an expert MSP because we don't want to make a public offer in the market, we just want to manage certain customers.
It should be displayed there. No special conditions are required such as the ones you've mentioned. Are you definitely signed in to your own partner/MSP tenant with an account that has delegated access to the customers? Does anything show up under delegations within the Azure Lighthouse section?
If you have access to the customer tenant, does your company show up under Service Providers within Azure Lighthouse on the Azure portal?
Case closed, the Service Principal itself doesn't have the privileges on the service provider's tenant to make your user a reader. So the solution for this was:
Remove the offer in the customer tenant.
Add new authorization in the ARM template for a user/group with "Reader" built-in role id. (In our case, we decided to use an AD group because people in the organization is temporary)
Upload the new ARM template and re-onboarded the client.
After a couple of hours, the client's subscription showed in the subscription list in the section: Directories + subscriptions, checked it, and saw all the resources from the service provider's tenant.
I found a solution for this issue.
The Azure Lighthouse->My customers list on the azure portal only shows subscriptions activated in the global directories and subscription filter.
Please go to the global directories and subscriptions filter (in the portal top navigation) and open the drop downs for directories and for subscriptions and check, if your customer subscription appears here.
If yes, select all entries in both drop downs.
After that go back to Azure Lighthouse->My customers
and check, if the customer subscription appears now.
I am unable to view any services in my azure portal. A couple of days back everything was visible.
I think there's some permissions issue. I am logging as Global Admin on the portal.
[UPDATE]: I was trying to publish a web application from visual studio to my azure account and when I select my account, it says "There are no Azure subscriptions associated with this account". Is it that my account is suspended or deactivated or so?
You are signed in to the classic portal with an AAD subscription. These subscriptions don't support using other services. You might be signed in to the wrong directory. Use the "Subscriptions" menu at the top to switch. If you don't have that, you could also be signed in to the wrong account. Some people have used "work/school" (AAD) email addresses to sign up for a "personal" (Microsoft Account) account. If that happens, you'll see a prompt to pick one of the two when you sign in. If you don't see your subscription, it may be assigned to the personal/MSA account. You can grant access to the other one to avoid this.
I am trying to learn how to use Azure's web app services to set up a custom domain, but I am getting a consistent issue with it think I don't have a paid subscription. I am on the "Shared" service level and have a Pay-As-You-Go subscription, yet when I try to click the "Buy Domains" button in the Web App dashboard for my application it automatically shows me a screen "To buy a custom domain, you must have a paid Azure subscription." I have been try to refresh and reconfigure all the options related to my subscription, but it won't seem to let me buy a domain. Are the subscriptions I have not sufficient to do this?
I experienced the same problem. I had just signed up for a new azure account and then converted my subscription from free-trial to pay-as-you-go. Somehow this doesn't propagate correctly because the subscription still showed the free trial credit. I filed a ticket with MS Support, and received an actual phone call back from a support person. They resolved it behind the scenes. Credit disappeared, but my subscription was successfully now showing pay-as-you-go in the portal.
Successfully buying a domain through the portal is another challenge though.
Are you the Service-Admin or Co-Admin?
It might be an operation only Service-Admin can execute.
I'm a developer that has an Azure account for my own dev stuff. I log into my dev account using me#hotmail.com.
Next, I set up a client with their own Azure account, then invited myself via me#hotmail.com and set myself as a co-administrator for the client's subscription. When I subsequently log into Azure using me#hotmail.com, I only see my own subscriptions/resources, etc.
Is there a way that I can log into Azure, using me#hotmail.com, and have access to both my dev stuff as well as my client's subscription from within the portal (specifically portal.azure.com).
Not sure if this is supported or if I'm doing something wrong. Thanks
You can only view subscriptions for a single directory at a time.
If you click your name in the top right corner of the portal you can select which directory you want to work from.
There is a suggestion on the Azure feedback site to add the ability to view subscriptions from all directories: http://feedback.azure.com/forums/223579-azure-preview-portal/suggestions/4761959-manage-subscriptions-across-all-available-director
I want to delete an Azure active directory. Sadly I receive error messages.
The first one: "Directory has one or more Azure subscriptions". Yes that's normal, I want to delete everything to start over my Azure account.
This AD directory just contains one user, which is a global administrator (me with a different email). When I try to modify it to put it as a standard user, I receive this error: "Please try again. If the problem persists, contact support."
So actually I can't delete this AD directory. I tried to get help from the support but I didn't find a way to have more information.
Do you have an idea of how can I do that? Any help would be appreciated (thanks).
The problem isn't the one user in your Azure AD, but the whole AD is tied to your subscription.
You need to create a new Azure AD and connect it to your subscription.
Steps to make this work:
Create a new ID
go to manage.windowsazure.com
select Settings (bottom left menu item
Select your subscription
Press "Edit Directory" in the bottom navigation bar
Associate the new Azure AD
Now you should be able to delete the old Azure AD.
I just wrote a blog about how to delete Azure AD tenants. Unfortunately you often need to resort to using PowerShell to finally clear out any lingering Principals and/or registered applications.
See https://blog.nicholasrogoff.com/2017/01/20/how-to-delete-an-azure-active-directory-add-tenant/