You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Associate or add an Azure subscription to your Azure Active Directory tenant
20
20
21
-
An Azure subscription has a trust relationship with Azure Active Directory (Azure AD), which means that the subscription trusts Azure AD to authenticate users, services, and devices. Multiple subscriptions can trust the same Azure AD directory, but each subscription can only trust a single directory.
21
+
An Azure subscription has a trust relationship with Azure Active Directory (Azure AD). A subscription trusts Azure AD to authenticate users, services, and devices.
22
22
23
-
If your subscription expires, you lose access to all the other resources associated with the subscription. However, the Azure AD directory remains in Azure, letting you associate and manage the directory using a different Azure subscription.
23
+
Multiple subscriptions can trust the same Azure AD directory. Each subscription can only trust a single directory.
24
24
25
-
All of your users have a single *home* directory for authentication. However, your users can also be guests in other directories. You can see both the home and guest directories for each user in Azure AD.
25
+
If your subscription expires, you lose access to all the other resources associated with the subscription. However, the Azure AD directory remains in Azure. You can associate and manage the directory using a different Azure subscription.
26
+
27
+
All of your users have a single *home* directory for authentication. Your users can also be guests in other directories. You can see both the home and guest directories for each user in Azure AD.
26
28
27
29
> [!Important]
28
-
> When you associate a subscription to a different directory, users that have roles assigned using [role-based access control (RBAC)](../../role-based-access-control/role-assignments-portal.md)will lose their access. Classic subscription administrators (Service Administrator and Co-Administrators) will also lose access.
30
+
> When you associate a subscription to a different directory, users that have roles assigned using [role-based access control (RBAC)](../../role-based-access-control/role-assignments-portal.md) lose their access. Classic subscription administrators, including Service Administrator and Co-Administrators, also lose access.
29
31
>
30
32
> Policy Assignments are also removed from a subscription when the subscription is associated with a different directory.
31
-
>
32
-
> Additionally, moving your Azure Kubernetes Service (AKS) cluster to a different subscription, or moving the cluster-owning subscription to a new tenant, causes the cluster to lose functionality due to lost role assignments and service principals rights. For more information about AKS, see [Azure Kubernetes Service (AKS)](https://docs.microsoft.com/azure/aks/).
33
+
>
34
+
> Moving your Azure Kubernetes Service (AKS) cluster to a different subscription, or moving the cluster-owning subscription to a new tenant, causes the cluster to lose functionality due to lost role assignments and service principal's rights. For more information about AKS, see [Azure Kubernetes Service (AKS)](https://docs.microsoft.com/azure/aks/).
35
+
33
36
34
37
## Before you begin
35
38
36
-
Before you can associate or add your subscription, you must perform the following tasks:
39
+
Before you can associate or add your subscription, do the following tasks:
40
+
41
+
- Review the following list of changes and how you might be affected:
37
42
38
-
1. Review the following list of changes and how you might be affected:
43
+
- Users that have been assigned roles using RBAC will lose their access
44
+
- Service Administrator and Co-Administrators will lose access
45
+
- If you have any key vaults, they'll be inaccessible and you'll have to fix them after association
46
+
- If you have any managed identities for resources such as Virtual Machines or Logic Apps, you must re-enable or recreate them after the association
47
+
- If you have a registered Azure Stack, you'll have to re-register it after association
39
48
40
-
- Users that have been assigned roles using RBAC will lose their access
41
-
- Service Administrator and Co-Administrators will lose access
42
-
- If you have any key vaults, they'll be inaccessible and you'll have to fix them after association
43
-
- If you have any managed identities for resources such as Virtual Machines or Logic Apps, you'll have to re-enable or recreate them after the association
44
-
- If you have a registered Azure Stack, you'll have to re-register it after association
49
+
- Sign in using an account that:
45
50
46
-
1. Sign in using an account that:
47
-
- Has an [Owner](../../role-based-access-control/built-in-roles.md#owner) role assignment for the subscription. For information about how to assign the Owner role, see [Manage access to Azure resources using RBAC and the Azure portal](../../role-based-access-control/role-assignments-portal.md).
48
-
- Exists in both the current directory that's associated with the subscription and in the new directory that's where you want to associate the subscription going forward. For more information about getting access to another directory, see [How do Azure Active Directory admins add B2B collaboration users?](../b2b/add-users-administrator.md).
51
+
- Has an [Owner](../../role-based-access-control/built-in-roles.md#owner) role assignment for the subscription. For information about how to assign the Owner role, see [Manage access to Azure resources using RBAC and the Azure portal](../../role-based-access-control/role-assignments-portal.md).
52
+
- Exists in both the current directory and in the new directory. The current directory is associated with the subscription. You'll associate the new directory with the subscription. For more information about getting access to another directory, see [Add Azure Active Directory B2B collaboration users in the Azure portal](../b2b/add-users-administrator.md).
49
53
50
-
1. Make sure you're not using an Azure Cloud Service Providers (CSP) subscription (MS-AZR-0145P, MS-AZR-0146P, MS-AZR-159P), a Microsoft Internal subscription (MS-AZR-0015P), or a Microsoft Imagine subscription (MS-AZR-0144P).
51
-
52
-
## To associate an existing subscription to your Azure AD directory
54
+
- Make sure you're not using an Azure Cloud Service Providers (CSP) subscription (MS-AZR-0145P, MS-AZR-0146P, MS-AZR-159P), a Microsoft Internal subscription (MS-AZR-0015P), or a Microsoft Imagine subscription (MS-AZR-0144P).
55
+
56
+
## Associate a subscription to a directory<aname="to-associate-an-existing-subscription-to-your-azure-ad-directory"></a>
57
+
58
+
To associate an existing subscription to your Azure AD directory, follow these steps:
53
59
54
60
1. Sign in and select the subscription you want to use from the [Subscriptions page in Azure portal](https://portal.azure.com/#blade/Microsoft_Azure_Billing/SubscriptionsBlade).
55
61
56
-
2. Select **Change directory**.
62
+
1. Select **Change directory**.
57
63
58
-
64
+
59
65
60
-
3. Review any warnings that appear, and then select **Change**.
66
+
1. Review any warnings that appear, and then select **Change**.
61
67
62
68
63
69
64
70
The directory is changed for the subscription and you get a success message.
65
71
66
72
67
-
4. Use the **Directory switcher** to go to your new directory. It can take several hours for everything to show up properly. If it seems to be taking too long, check the **Global subscription filter** for the moved subscription to make sure it's not hidden. You may need to sign out of the Azure portal and sign back in to be able to see the new directory.
68
73
69
-
74
+
Use **Switch directory** to go to your new directory. It can take several hours for everything to show up properly. If it seems to be taking too long, check the **Global subscription filter**. Make sure the moved subscription isn't hidden. You may need to sign out of the Azure portal and sign back in to see the new directory.
70
75
71
-
Changing the subscription directory is a service-level operation, so it doesn't affect subscription billing ownership. The Account Admin can still change the Service Admin from the [Account Center](https://account.azure.com/subscriptions). To delete the original directory, you must transfer the subscription billing ownership to a new Account Admin. To learn more about transferring billing ownership, see [Transfer ownership of an Azure subscription to another account](../../billing/billing-subscription-transfer.md).
76
+
72
77
73
-
## Post association steps
74
-
After you associate a subscription to a different directory, there might be additional steps that you must perform to resume operations.
78
+
Changing the subscription directory is a service-level operation, so it doesn't affect subscription billing ownership. The Account Admin can still change the Service Admin from the [Account Center](https://account.azure.com/subscriptions). To delete the original directory, you must transfer the subscription billing ownership to a new Account Admin. To learn more about transferring billing ownership, see [Transfer ownership of an Azure subscription to another account](../../billing/billing-subscription-transfer.md).
75
79
76
-
1. If you have any key vaults, you must change the key vault tenant ID. For more information, see [Change a key vault tenant ID after a subscription move](../../key-vault/key-vault-subscription-move-fix.md).
80
+
## Post-association steps
77
81
78
-
2. If you were using system-assigned Managed Identities for resources, you must re-enable these. If you were using user-assigned Managed Identities, you must re-create these. After re-enabling or recreating the Managed Identities, you must re-establish the permissions assigned to those identities. For more information see [What is managed identities for Azure resources?](../managed-identities-azure-resources/overview.md).
82
+
After you associate a subscription to a different directory, you might need to do the following tasks to resume operations:
79
83
80
-
3. If you have registered an Azure Stack using this subscription, you must re-register. For more information, see [Register Azure Stack with Azure](/azure-stack/operator/azure-stack-registration).
84
+
- If you have any key vaults, you must change the key vault tenant ID. For more information, see [Change a key vault tenant ID after a subscription move](../../key-vault/key-vault-subscription-move-fix.md).
81
85
86
+
- If you used system-assigned Managed Identities for resources, you must re-enable these identities. If you used user-assigned Managed Identities, you must re-create these identities. After re-enabling or recreating the Managed Identities, you must re-establish the permissions assigned to those identities. For more information, see [What is managed identities for Azure resources?](../managed-identities-azure-resources/overview.md).
82
87
88
+
- If you've registered an Azure Stack using this subscription, you must re-register. For more information, see [Register Azure Stack with Azure](/azure-stack/operator/azure-stack-registration).
83
89
84
90
## Next steps
85
91
86
-
- To create a new Azure AD tenant, see [Access Azure Active Directory to create a new tenant](active-directory-access-create-new-tenant.md)
92
+
- To create a new Azure AD tenant, see [Quickstart: Create a new tenant in Azure Active Directory](active-directory-access-create-new-tenant.md).
87
93
88
-
- To learn more about how resource access is controlled in Microsoft Azure, see [Understanding resource access in Azure](../../role-based-access-control/rbac-and-directory-admin-roles.md)
94
+
- To learn more about how Microsoft Azure controls resource access, see [Classic subscription administrator roles, Azure RBAC roles, and Azure AD administrator roles](../../role-based-access-control/rbac-and-directory-admin-roles.md).
89
95
90
-
- To learn more about how to assign roles in Azure AD, see [How to assign directory roles to users with Azure Active Directory](active-directory-users-assign-role-azure-portal.md)
96
+
- To learn more about how to assign roles in Azure AD, see [Assign administrator and non-administrator roles to users with Azure Active Directory](active-directory-users-assign-role-azure-portal.md).
0 commit comments