One of the most difficult problems in cloud management, that enterprises face today, is getting lost in the details of building a cloud infrastructure that serves them. In this article, I hope to clear up any confusion about the process of managing an Azure EA, including issues such as enrollment, the account, and managing your subscription, by looking at the entire hierarchy of Microsoft Azure.
To manage and access your multiple Azure enrollments, you need to be an enterprise administrator (there can be an unlimited number of enterprise administrators).
You’ll also want to change your Enrollment Authentication Level to ‘Mixed Account‘ so that you have the ability to add both Microsoft Accounts and/or Work or School accounts as Account Administrators.
Once you select the enrollment you are working with, select ‘Department‘ at the top. This is where you’ll see the departments of which you are the department administrator. Use it to set up more departments which can be setup as a logical segmentation of a company or application.
At the outset, let me state that this no generic account (as opposed to what the department and subscription is). In fact, it’s more of an individual account that will ultimately become the Azure Account Administrator. It can manage and setup Azure subscriptions, at which point it will also become – by default – the Service Administrator for the subscription as well at the time of subscription creation.
Notice, that the Account Administrator is managed using two portals.
Only use http://ea.azure.com to setup the Account Administrator under the relevant department, whether it be a Microsoft Account or a work/school (organizational) account.
Once you do this, it can take up to 24 hours for it to actually add itself. Until then it will show up as pending.
Once it is setup, the email you used when adding the Azure Account Administrator will be sent an email to acknowledge being added as an Azure Account Administrator, and will provide a link to log into the Azure account portal.
You can expedite the process, if you get the new Azure account administrator to log on to http://ea.azure.com with their account. It will ask them to confirm – with a warning. If the new Azure account administrator has other subscriptions anywhere else e.g. Pay-As-You-Go, then these will all get transferred to under the EA at this time including all billing for the Azure subscription, so be careful!!! If the new Azure account administrator doesn’t manage any Azure subscriptions, then you don’t really need to worry about the warning.
At this point, it’s important to note that even though adding a work/school account from an Azure AD directory is an option, the Directory doesn’t have to have any affiliation with the EA, nor does the Microsoft Account. This means, that you can use an account from a new Azure AD directory, or an existing Azure AD directory. For example, if you are using Office 365 and AD Connect to sync on-prem accounts to Azure AD, you can use any of these accounts.
Once the account has been completed being setup, the Account Administrator will get an email.
Now, all Azure subscriptions can be created and managed by the Account Administrator. This is done by visiting the Azure Account portal at http://account.windowsazure.com and by clicking on ‘Account,’ at the top.
Notice, that you now have the option of adding a new subscription, and you can also edit an existing subscription. If you click on an existing subscription, by default, all Azure Enterprise based subscriptions are named ‘Microsoft Azure Enterprise.’ In addition, you now also have the option to edit your subscription details, or rename the Azure subscription in the Azure portal. Under ‘Edit Subscription Details,’ you can change the Service Administrator to make it someone else.
Remember, that with all new Azure subscriptions which are created by the Account Administrator, Azure stamps the Account Administrator as the Service Administrator by default, this is where you change that.
The Azure Hierarchy
The Azure Hierarchy is where you can receive a clear and visual display that will provide you with an overview of the entire structure.
For more details, see the Channel 9 website on the subject of Enterprise Azure Portal https://channel9.msdn.com/blogs/EA.Azure.com