In this tutorial we will look into the details of Azure account and subscriptions and see what exactly they mean. We will also see how to set the administrative roles to the users who need access to Azure to manage services.
Before going into the subject it is important to understand the user account to access Windows Azure, which is as usual an combination of email and password, used to authenticate users. Now user account, specifically User ID, comes in two forms : Microsoft accounts and organizational accounts.
Organizational accounts are different from Microsoft accounts because they are sourced from Azure Active Directory. Because organizational accounts are created from within Azure Active Directory, you have more options for managing them. For example, Organizational accounts can be supplemented with multi-factor authentication, which requires the user to enter additional information to verify their identity.
So, as a general rule, use Organizational accounts whenever you need to assign administrative access to Azure. Every Azure subscription has a default directory that you can use to create organizational accounts.
In this tutorial I've used the microsoft account.
Windows Azure Account
Windows Azure Account is a shell to provide usage and billing reporting of the services. He is also the Account Administrator of that account.
Subscription
A Windows Azure subscription grants you access to Windows Azure services and to the Windows Azure Platform Management Portal. In order to deploy services and data to Windows Azure, you need a Windows Azure subscription. hey also help you control how resource usage is reported, billed, and paid for. Each subscription can have a different billing and payment setup, so you can have different subscriptions and different plans by department, project, regional office, and so on. Every cloud service belongs to a subscription, and the subscription ID may be required for programmatic operations.
Account Administrator
The Account Administrator for a subscription is the only person with access to the Account Center. (https://account.windowsazure.com/Home/Index)
They can create subscriptions, cancel subscriptions for their account, update the service administrator and co-administrator for an individual subscription. He is the person responsible for paying the subscription bill. Normally, the Account Administrator has financial responsibilities in your company. This person is also the default Service Administrator for the subscription.
The Account Administrator does not have any other access to services in that subscription; they need to also be the Service Administrator or a co-administrator for that. For security reasons, the Account Administrator for a subscription can only be changed with a call to Azure support. The Account Administrator can easily reassign the Service Administrator for a subscription at the Account Center at any time.
Service Administrator
Service Administrator are authorized to access Azure Management Portal for all subscriptions in the account.Normally, the Service Administrator is a developer, system administrator, or other IT person responsible for IT services in your company. By default, it is same as the Account Administrator when a subscription is created but can be changed later. The Service Administrator is the first co-administrator for a subscription. Like other co-administrators, the Service Administrator has management access to cloud resources using the Azure Management Portal, as well as tools like Visual Studio, other SDKs, and command line tools like PowerShell. The Service Administrator can also add and remove other co-administrators.
Co-Administrators
Imagine the scenario of large enterprise. There can be a big numbers of servers and application to manage and obviously a single person cannot handle it. This is the reason the service administrator can create Co-Administrators to help manage Windows Azure operations.
Co-administrators are identified by Windows Live ID. Therefore, a person that you want to be a co-administrator of your subscription must have his or her own Windows Live ID. If they do not have a Windows Live ID, they can create one at login.live.com. Co-administrators have complete access to the subscription services. They can even add or delete other co-administrators. However, they cannot remove the Service Owner (the Service Administrator). Also, co-administrators do not have access to payment/billing information (things managed by the Account Administrator).
Let's see an example of all of these terms. I've sign up for free Azure trial account. I'll be the account owner (with my windows live ID username/pwd) of this account. I'm the Account Administrator for this account and by default I'm also the Service Administrator of this account.
Open Windows Azure Management Portal and scroll all the way down to "Settings" on the left side. After clicking on "Settings", go to the Administartor tab and you can see all the administrator listed for that subscription as shown in the image below.
As I told you before by default, Service Administrator is same as the Account Administrator when a subscription is created. We can change the Service Administrator, but not from here. I'll show in a moment how to do that. You can see that the Service Administrator is the first co-administrator for a subscription.
To add a Co-Administrator , while still in Administrator tab under Settings, click on the add button at the bottom. A pop windows will get opened to add co-administrator.
Enter the email address of the co-administrator. Choose the subscription, here I only have the free subscription. The co-administrator must be either a Microsoft Account or a user account within the Default Directory directory. Click the OK button and the co-administrator will be created. You can add upto 200 co-administrator per subscription (in addition to Service Administrator).
- Co-administrators with an organizational account sign in to the portal using a password that they receive in email or that is provided by the system administrator.
- Co-administrators with a Microsoft account sign in to the portal using the password for that account.
Crucial differences between the service administrator and co-administrators:
To see all the subscriptions under your account, go to Account Center (https://account.windowsazure.com/Subscriptions) , or while still in Azure portal click on the account name on top right side and then click on "View my bill" , this will open Account center. Click on subscription tab and you can see all the subscriptions under your account. You can even add a new subscription from here.
Once you clicked on any subscription, you can see the details related to billing, usage, accounts related to that subscription. You can also edit some of the details related to account like Change Payment Method, Edit Subscription Details, Change Address, Cancel Subscription from here.
Let's see how you can change the Service Administrator. While still on the Subscription Summary page, go to the very end of the page, and there on the right hand side you can see a link to "Edit subscription details".
You can also see the account details in that section.
Click on that link and new pop-up windows will open that let you to change the Service Administrator.
Before going into the subject it is important to understand the user account to access Windows Azure, which is as usual an combination of email and password, used to authenticate users. Now user account, specifically User ID, comes in two forms : Microsoft accounts and organizational accounts.
- Microsoft accounts take the form <user>@outlook.com <user>@hotmail.com or <user>@live.com. It is good for single person but not for the organization.
- Organizational accounts take the form judy@contoso.onmicrosoft.com or judy@contoso.com, for example. “Contoso” can be any domain name. Good for middle and large enterprise.
Organizational accounts are different from Microsoft accounts because they are sourced from Azure Active Directory. Because organizational accounts are created from within Azure Active Directory, you have more options for managing them. For example, Organizational accounts can be supplemented with multi-factor authentication, which requires the user to enter additional information to verify their identity.
So, as a general rule, use Organizational accounts whenever you need to assign administrative access to Azure. Every Azure subscription has a default directory that you can use to create organizational accounts.
In this tutorial I've used the microsoft account.
Windows Azure Account
Windows Azure Account is a shell to provide usage and billing reporting of the services. He is also the Account Administrator of that account.
Subscription
A Windows Azure subscription grants you access to Windows Azure services and to the Windows Azure Platform Management Portal. In order to deploy services and data to Windows Azure, you need a Windows Azure subscription. hey also help you control how resource usage is reported, billed, and paid for. Each subscription can have a different billing and payment setup, so you can have different subscriptions and different plans by department, project, regional office, and so on. Every cloud service belongs to a subscription, and the subscription ID may be required for programmatic operations.
Account Administrator
The Account Administrator for a subscription is the only person with access to the Account Center. (https://account.windowsazure.com/Home/Index)
They can create subscriptions, cancel subscriptions for their account, update the service administrator and co-administrator for an individual subscription. He is the person responsible for paying the subscription bill. Normally, the Account Administrator has financial responsibilities in your company. This person is also the default Service Administrator for the subscription.
The Account Administrator does not have any other access to services in that subscription; they need to also be the Service Administrator or a co-administrator for that. For security reasons, the Account Administrator for a subscription can only be changed with a call to Azure support. The Account Administrator can easily reassign the Service Administrator for a subscription at the Account Center at any time.
Service Administrator
Service Administrator are authorized to access Azure Management Portal for all subscriptions in the account.Normally, the Service Administrator is a developer, system administrator, or other IT person responsible for IT services in your company. By default, it is same as the Account Administrator when a subscription is created but can be changed later. The Service Administrator is the first co-administrator for a subscription. Like other co-administrators, the Service Administrator has management access to cloud resources using the Azure Management Portal, as well as tools like Visual Studio, other SDKs, and command line tools like PowerShell. The Service Administrator can also add and remove other co-administrators.
Co-Administrators
Imagine the scenario of large enterprise. There can be a big numbers of servers and application to manage and obviously a single person cannot handle it. This is the reason the service administrator can create Co-Administrators to help manage Windows Azure operations.
Co-administrators are identified by Windows Live ID. Therefore, a person that you want to be a co-administrator of your subscription must have his or her own Windows Live ID. If they do not have a Windows Live ID, they can create one at login.live.com. Co-administrators have complete access to the subscription services. They can even add or delete other co-administrators. However, they cannot remove the Service Owner (the Service Administrator). Also, co-administrators do not have access to payment/billing information (things managed by the Account Administrator).
Let's see an example of all of these terms. I've sign up for free Azure trial account. I'll be the account owner (with my windows live ID username/pwd) of this account. I'm the Account Administrator for this account and by default I'm also the Service Administrator of this account.
Open Windows Azure Management Portal and scroll all the way down to "Settings" on the left side. After clicking on "Settings", go to the Administartor tab and you can see all the administrator listed for that subscription as shown in the image below.
As I told you before by default, Service Administrator is same as the Account Administrator when a subscription is created. We can change the Service Administrator, but not from here. I'll show in a moment how to do that. You can see that the Service Administrator is the first co-administrator for a subscription.
To add a Co-Administrator , while still in Administrator tab under Settings, click on the add button at the bottom. A pop windows will get opened to add co-administrator.
Enter the email address of the co-administrator. Choose the subscription, here I only have the free subscription. The co-administrator must be either a Microsoft Account or a user account within the Default Directory directory. Click the OK button and the co-administrator will be created. You can add upto 200 co-administrator per subscription (in addition to Service Administrator).
- Co-administrators with an organizational account sign in to the portal using a password that they receive in email or that is provided by the system administrator.
- Co-administrators with a Microsoft account sign in to the portal using the password for that account.
Crucial differences between the service administrator and co-administrators:
- Co-administrators can’t delete the Service Administrator from the Azure Management Portal. Only the Account Administrator can change this assignment at the Account Center.
- The Service Administrator is the only user authorized to change a subscription’s association with a directory in the Azure Management Portal.
To see all the subscriptions under your account, go to Account Center (https://account.windowsazure.com/Subscriptions) , or while still in Azure portal click on the account name on top right side and then click on "View my bill" , this will open Account center. Click on subscription tab and you can see all the subscriptions under your account. You can even add a new subscription from here.
Once you clicked on any subscription, you can see the details related to billing, usage, accounts related to that subscription. You can also edit some of the details related to account like Change Payment Method, Edit Subscription Details, Change Address, Cancel Subscription from here.
Let's see how you can change the Service Administrator. While still on the Subscription Summary page, go to the very end of the page, and there on the right hand side you can see a link to "Edit subscription details".
You can also see the account details in that section.
Click on that link and new pop-up windows will open that let you to change the Service Administrator.
Some best practices you should follow while creating subscriptions and administrators.