Skip to content

Latest commit

 

History

History
100 lines (75 loc) · 6.06 KB

grant-access-to-create-subscription.md

File metadata and controls

100 lines (75 loc) · 6.06 KB
title description services author manager editor ms.assetid ms.service ms.devlang ms.topic ms.tgt_pltfrm ms.workload ms.date ms.author
Grant access to create Azure Enterprise subscriptions| Microsoft Docs
Learn how to give a user or service principal the ability to programmatically create Azure Enterprise subscriptions.
azure-resource-manager
adpick
adpick
azure-resource-manager
na
conceptual
na
na
06/05/2018
adpick

Grant access to create Azure Enterprise subscriptions (preview)

As an Azure customer on Enterprise Agreement (EA), you can give another user or service principal permission to create subscriptions billed to your account. In this article, you learn how to use Role-Based Access Control (RBAC) to share the ability to create subscriptions, and how to audit subscription creations. You must have the Owner role on the account you wish to share.

To create a subscription, see Programmatically create Azure Enterprise subscriptions (preview).

Delegate access to an enrollment account using RBAC

To give another user or service principal the ability to create subscriptions against a specific account, give them an RBAC Owner role at the scope of the enrollment account. The following example gives a user in the tenant with principalId of <userObjectId> (for [email protected]) an Owner role on the enrollment account. To find the enrollment account ID and principal ID, see Programmatically create Azure Enterprise subscriptions (preview).

REST

PUT  https://management.azure.com/providers/Microsoft.Billing/enrollmentAccounts/747ddfe5-xxxx-xxxx-xxxx-xxxxxxxxxxxx/providers/Microsoft.Authorization/roleAssignments/<roleAssignmentGuid>?api-version=2015-07-01

{
  "properties": {
    "roleDefinitionId": "/providers/Microsoft.Billing/enrollmentAccounts/providers/Microsoft.Authorization/roleDefinitions/<ownerRoleDefinitionId>",
    "principalId": "<userObjectId>"
  }
}

When the Owner role is successfully assigned at the enrollment account scope, Azure responds with information of the role assignment:

{
  "properties": {
    "roleDefinitionId": "/providers/Microsoft.Billing/enrollmentAccounts/providers/Microsoft.Authorization/roleDefinitions/<ownerRoleDefinitionId>",
    "principalId": "<userObjectId>",
    "scope": "/providers/Microsoft.Billing/enrollmentAccounts/747ddfe5-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "createdOn": "2018-03-05T08:36:26.4014813Z",
    "updatedOn": "2018-03-05T08:36:26.4014813Z",
    "createdBy": "<assignerObjectId>",
    "updatedBy": "<assignerObjectId>"
  },
  "id": "/providers/Microsoft.Billing/enrollmentAccounts/providers/Microsoft.Authorization/roleDefinitions/<ownerRoleDefinitionId>",
  "type": "Microsoft.Authorization/roleAssignments",
  "name": "<roleAssignmentGuid>"
}

PowerShell

Use the New-AzureRmRoleAssignment to give another user Owner access to your enrollment account.

New-AzureRmRoleAssignment -RoleDefinitionName Owner -ObjectId <userObjectId> -Scope /providers/Microsoft.Billing/enrollmentAccounts/747ddfe5-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Azure CLI

Use the az role assignment create to give another user Owner access to your enrollment account.

az role assignment create --role Owner --assignee-object-id <userObjectId> --scope /providers/Microsoft.Billing/enrollmentAccounts/747ddfe5-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Once a user becomes an RBAC Owner for your enrollment account, they can programmatically create subscriptions under it. A subscription created by a delegated user still has the original Account Owner as Service Admin, but it also has the delegated user as an Owner by default.

Audit who created subscriptions using activity logs

To track the subscriptions created via this API, use the Tenant Activity Log API. It's currently not possible to use PowerShell, CLI, or Azure portal to track subscription creation.

  1. As a tenant admin of the Azure AD tenant, elevate access then assign a Reader role to the auditing user over the scope /providers/microsoft.insights/eventtypes/management.
  2. As the auditing user, call the Tenant Activity Log API to see subscription creation activities. Example:
GET "/providers/Microsoft.Insights/eventtypes/management/values?api-version=2015-04-01&$filter=eventTimestamp ge '{greaterThanTimeStamp}' and eventTimestamp le '{lessThanTimestamp}' and eventChannels eq 'Operation' and resourceProvider eq 'Microsoft.Subscription'"

Note

To conveniently call this API from the command line, try ARMClient.

Next steps