How can I add an Azure DevOps Organization user if the organization owner is just a guest of the linked Azure AD and not a domain member?

0
votes

I have an Azure Devops organization that is linked to an Azure Active Directory. This organization has projects and pipelines for deploying applications to App Services in the linked Azure AD.

Recently, one of my user account (the one with the Visual Studio Enterprise Subscription) was made the organization owner and all other project users were deleted. However, my account that is now the only user in the Azure DevOps organization is just a guest account type of the linked Azure Ad, and not an actual member of the Azure AD.

I need to add new users back to the organization but since my user account is just a guest of the linked Azure AD, when I try to add users, I get an info dialog that states that since I am only a Guest of the Azure AD domain, I can't see the domain members I want to add and so the add user process fails.

enter image description here

As I stated earlier, my account is the Organization Owner. I also assigned my guest user account to the Global Administrators role in the linked Azure AD, but I still cannot add domain users to the Azure DevOps organization.

This organization has production code in the repo as well as build and deployment pipelines that I do not want to lose access to or lose the ability to deploy to the App Services in the linked Azure AD, so I am concerned about taking any action until I know exactly what I need to do to be able to add users from the linked Azure AD into the organization.

Any advice as to how I can add users from the linked Azure AD back to this organization would be greatly appreciated.

2
azureazure-devopsazure-active-directory

2 Answers

0
votes

This is just a guess, but DevOps could be looking at your userType and show the message based on that. Global admin would definitely allow you to list the users.

You could try using PowerShell to change your userType from Guest to Member. E.g. with AAD PowerShell v2:

Set-AzureADUser -ObjectId 'your-user-object-id-in-tenant' -UserType 'Member'

It's actually something that isn't super-well-known. Guest/member and local/external user are two different things. External users just become Guests by default, which restricts what they can do.

0
votes

Add the guest users to Azure AD directly, before you try to give them access in DevOps. After adding a new guest user, that new guest can be given access to DevOps by your subscription admin.

Or create yourself a domain user in your Azure AD with the proper privileges too.

e.g. If your Azure AD domains is "MyMsdnAzureADDomain.onmicrosoft.com" (or a Custom Doamin like "mycompany.com" if you have such domain registered in Azure).

A) Create new domain user in MyMsdnAzureADDomain.onmicrosoft.com

  • The new user is would be MyNewUser@MyMsdnAzureADDomain.onmicrosoft.com

B) Give that new user full admin in Azure AD and your DevOps (or tailor your permissions to your needs).

C) Login into Azure using that new user to manage your DevOps.