Introduction
For training purposes, I had to solve the following task: I needed to create a new organization inside Azure, become its administrator and add my coworkers as users that can use this new account to play with Azure. Task seems not so complicated, but I didn't find a good description of how to do this, so I decided to create my own one.
Solution
- First of all, I created a new account in Azure, this account is Global Administrator for my Azure Active directory, that is default BTW:
-
I've created a Pay-As-You-Go subscription for my account, it was automatically connected to my Active Directory. Note the subscription may connect only to one AD, while AD can have multiple subscriptions connected.
From subscription page in "Access Control" section, I've invited my coworker\s to work with it: I gave "Contributor" role to my coworkers, but it can be anyone you decide to use. Same for "Assign access to" I used default value, that can be changed according to your needs.
Next step is you enter user mail for the person you want to invite to your subscription and press "Save". User will receive notification to his mail with the request to join your default Active Directory. Note: User joins your active directory as a guest as well, not your subscription only. You can first invite this user to your active directory and then from there to your subscription, but in my case, I did it from subscription. As you can see in my AD users, I see new user:
As you can see, you can invite any user to your active directory and subscription. This shouldn't be a necessary user from your organization. We achieve this great flexibility due to B2B collaboration capabilities. You can first add such users from your Active Directory management and then share with them subscription only.
-
Once you added you user to subscription and AD, he will receive email with invitation:
-
When your invited user logs in to Azure Portal, he might have other directories to which he belongs to. To be able to work with your subscription and active directory, this user needs to switch to your directory and then he will be able to use and see your subscription:
-
Now let's try to create a new SQL DB from the account of the user that was invited:
As you can see, it used Pay-As-You-Go subscription.
-
Now let's go back to my original user and here we can see the newly created DB as well:
My original account will show all the resources from all the users inside the organization I just created.
-
Finally, after one month of usage, this DB is under my invited user, my original user received the payment request for this resource inside Pay-As-You-Go subscription:
The exact same picture I can see from my guest user.
-
From my root account, I've tried and successfully deleted resource that was created by my guest account.
In conclusion, Microsoft Azure gives us very flexible ability to create organization under specific account and share its subscription to guest users. By having that, we can control expenses from one place.
