I’ve been getting this same question with every client we enroll in Azure. It typically comes in as, “I can login and see everything in Azure; however my co-workers can’t. They’re Global Administrators in Office 365 just like I am.” Access control (IAM) on your Azure subscriptions is not inherently delegated. This is by design and for good reason.
In order to grant access to others per subscription follow the few steps below.
- Select Subscriptions in the navigation bar on the left.
- Select the name of the subscription from the Subscriptions blade.
- Select Access control (IAM) from the left menu.
- The Access control blade lists all users, groups, and applications that have been granted access to the resource group.
- Select Add on the Access control blade.
- Select the role that you wish to assign from the Select a role blade.
- Select the user, group, or application in your directory that you wish to grant access to. You can search the directory with display names, email addresses, and object identifiers.
These steps can also be followed to assign access on many resources in Azure.
A very common practice is to assign access control to a resource group.
- Select Resource groups in the navigation bar on the left.
- Select the name of the resource group from the Resource groups
- Select Access control (IAM) from the left menu.
- The Access control blade lists all users, groups, and applications that have been granted access to the resource group.
- Select Add on the Access control blade.
- Select the role that you wish to assign from the Select a role blade.
- Select the user, group, or application in your directory that you wish to grant access to. You can search the directory with display names, email addresses, and object identifiers.
Notice that some roles are scoped to This resource while others have Inherited it from another scope. Access is either assigned specifically to the resource group or inherited from an assignment to the parent subscription.
Brandon Stuart, PEI
