How do we add a second global admin for Azure AD B2C? Do we add them as guest account and assign that guest GA? When adding a normal user, it says we can’t add a dot.state.fl.us email. Should we authorize it, or will that screw up our primary tenant? (Azure AD).
7
votes
3 Answers
7
votes
You can either create a local (or member) user in your Azure AD B2C directory and/or invite an external (or guest) user from your Azure AD enterprise directory to your Azure AD B2C directory.
To create a member user, select "New user" in the "Users and groups - All users" blade of your Azure AD B2C directory.
(This member user must be created with the domain name of your Azure AD B2C directory.)
To invite a guest user, select "New guest user" in this same blade.
In both cases, you can assign the member or guest user to the Global Administrator role, so that can manage your Azure AD B2C directory.
5
votes
@ChrisPadgett is correct. If you wan't to add a second Global administrator from an External Azure Active Directory do it like this:
Switch directory to your Azure AD B2C directory.
Select Users and click on New User. Might work with New guest user as well according to comments but I have not tested this myself.
Use Invite user and fill in the required fields, use an email linked to the External Azure Active Directory.
In Roles select Global administrator and then Invite the email.
After the user then finishes setting up their account you will have two global administrators:
3
votes
Adding to the answer above,
If your original administrator account doesn't have an email address associated with it, you won't get the invite obviously...
The work around is: Ones you invited the external Active Directory user by its username (for example [email protected]) open the browser and go to https://portal.azure.com/[tenant2].onmicrosoft.com and sign in with the newly invited username and password (not the password from tenant1), you will get a prompt to accept the invite,
Ones done, the user will change from "invited" to "External Azure Active Directory" at which point you can sign in regularly and switch domains from the "Directory + Subscription" tab.
