Managing Azure Subscriptions

The Service Admin can

Access the azure portal and assign users the Co-Administrator role

add a Co-Owner in Azure Subscription

All resources > Subscriptions > Select Subscription > Access control (IAM) > Right click on an Owner > Add as co-admin Removing co-admins follow the same steps

Assign Owner Role in RBAC

All resources > Subscriptions > Select Subscription > Access control > add > Select Owner in Role box > Assign access to box > Select Azure user, group, or application > Select box > Enter Email or select user to add > Save You can narrow scope by adding to resource group instead of subscription.

Adding someone as an Administrator for an Azure Subscription

Assign them the Owner RBAC roll at the subscription scope Does not have access to other Subscriptions

RBAC (Role Based Access Control)

Duty Segregation Only the level of access needed for the job Permissions can be scoped to specific resources or activities

Account Admin

Has access to account center Can manage all subscriptions in an azure account Create new subscriptions Cancel Existing Subscriptions Change billing Change the service administrator account

Can a co-administrator change the association of subscriptions to azure directories ?

No

Can a co-administrator change the service administrator?

No, it can only be changed by the Account Administrator

Does the Account admin have access to the Azure portal?

No, the Service admin has access to the portal by default the service admin is the account admin unless changed

How many Service Administrators can an Azure Subscription have?

One

What can a Service administrator do?

Open support requests with Microsoft for azure and office 365 View the service dashboard and message center View only permissions except for opening support tickets and reading them Those assigned to the Exchange Online, SharePoint Online, and Skype for Business admin roles should also be assigned the service admin role so that they can view critical information in the Office 365 admin center, including health of the service and change and release notifications.

Three Key Administrator Roles

The Account Used to sign up for Azure is both -Account Admin -Service Admin Can be added to the subscription -Co-Admin The Service Admin & Co-Admin have the same access as users who have been assigned the Owner role These Admin have full access to Azure Subscription

True of False The Azure Security Center creates a default security policy automatically for each Azure subscription

True

Can a co-administrator assign users the co-administrator role?

Yes

Change account admin

select subscription in the Azure portal, and look under settings Click properties The account administrator for the subscription is shown in the account admin box. To change the account admin sign in to the Azure account center as an account admin. The Azure account center is located at account.windowsazure.com/Subscriptions Select the subscription Click transfer subscription specify the recipient Click finish to begin the process NOTE: warning about RBAC assignments. The recipient will receive an email with an acceptance link. After clicking the acceptance link, the recipient should follow the instructions, entering their payment information. When the recipient finishing following the instructions, the subscription is then transferred, and the recipient is the new account admin.

Change the service administrator

sign into the Azure Account Center as the account administrator select a subscription on the right side select Edit Subscription Details In the Service Administrator box provide the email address of the new service administrator.

How many Co-Admins can be added in a subscription?

up to 200

Does a co-admin have to be assigned the owner role in RBAC?

yes