Cannot see Azure AD even having role as global admin and co-admin on its subscription

3
votes

I don't really understand why on this case. My company has an azure subscription for development/testing environment.

At the beginning I am co-admin on this subscription with my Microsoft account. Now I need to manage applications under Azure AD of that subscription. So my Microsoft Account is leveraged to Global Admin of this Azure AD.

But even my MS account is leveraged to Global Admin, I cannot see or have access to Azure AD.

2
azureazure-active-directory
Could you upload the screenshot which display you cant access to Azure AD or error message? If you are Global Admin, you sure can see the default microsoft AD – Lily_user4045
@Lily_user4045: I cannot see the default Azure AD, that's it. – cuongle
stackoverflow.com/questions/30380869/… – cuongle

2 Answers

4
votes

After searching around and based on this article:

https://blogs.msdn.microsoft.com/dstfs/2015/12/23/issues-with-azure-active-directory-guest-users-in-aad-backed-visual-studio-team-services-accounts/

I am GUEST (user type) on Azure AD, so even I am global admin, I still cannot have access to this Azure AD.

From the link, this happens because:

One way you can become an AAD GUEST is when you are made a co-admin on an Azure subscription before being added to the AAD associated with it

It can be fixed by using powershell like @CtrlDo's answer. But you have to create an global admin with work/school account since this approach does not work with Microsoft account:

PowerShell - Connecting to Azure Active Directory using Microsoft Account

We have another approach which can be done in the UI that we think it's simpler:

  1. Remove my account out of co-admins of subscription.
  2. Remove my account out of Azure AD.
  3. Add my account back to Azure AD as Global Admin.
  4. Add my account back to be co-admin on subscription.

That does work perfectly

1
votes

When you were added to the AAD, your user type might have been set to "guest"

See https://azure.microsoft.com/en-us/documentation/articles/active-directory-create-users/ for more information.

See https://blogs.msdn.microsoft.com/dstfs/2015/12/23/issues-with-azure-active-directory-guest-users-in-aad-backed-visual-studio-team-services-accounts/ for an older post on how to view the issue in powershell and fix it.