Skip to main content

Microsoft Azure: Claiming your AppDirect Azure subscription

  • Updated

This article explains how to claim a Microsoft Azure subscription purchased through AppDirect and assign access to the person who will manage it. Because new Azure subscriptions are provisioned directly into your Microsoft Entra ID tenant without automatically granting user access, a Global Administrator must first claim the subscription and then delegate ownership.

Click here to download an abbreviated PDF version of this article. Please note this information is specific to Microsoft Azure only.

Before you begin

To complete this process, make sure you have the following:

  • A Microsoft Entra ID tenant associated with your organization, typically the same tenant used for Microsoft 365.
  • A user account with the Global Administrator role in that tenant.
  • The email address or User Principal Name (UPN) of the person who will be assigned as the Owner of the Azure subscription.

Important: The subscription should be claimed within 48 hours of provisioning to help avoid access issues.

Note: Azure subscriptions purchased through a CSP or marketplace such as AppDirect do not automatically grant access to users in the tenant. A Global Administrator must manually elevate access in order to assign the initial roles.

Step 1 - Identify your Global Administrators

If you are not sure who in your organization has the Global Administrator role, you can verify this in Azure or Microsoft Entra.

  1. Sign in to the Azure Portal or the Entra Admin Center.
  2. Open Microsoft Entra ID.
  3. Select Roles and administrators from the left-hand navigation.
  4. Search for Global Administrator.
  5. Open the role and review the Assignments or Members tab to see which users currently hold it.

Step 2 - Elevate Global Administrator access to view the new subscription

Newly provisioned subscriptions, including those purchased through AppDirect, may not be visible to a Global Administrator until access is elevated at the tenant root level.

  1. Sign in to the Azure portal as a Global Administrator.
  2. Go to Microsoft Entra ID → Properties.
  3. Find Access management for Azure resources and set it to Yes.
  4. Click Save.
  5. Sign out of the portal, then sign back in so the new permissions take effect.

After this change, the Global Administrator will have User Access Administrator permissions across all subscriptions in the tenant, including the new AppDirect-provisioned subscription.

Step 3 - Assign the Owner role to the intended user

Once the subscription is visible, assign the Owner role to the user who will manage the Azure environment.

  1. In the Azure portal, search for and open Subscriptions.
  2. Select the AppDirect-provisioned subscription. It may appear as Azure plan or Microsoft Azure - CSP.
  3. In the left-hand menu, select Access control (IAM).
  4. Click + Add, then select Add role assignment.
  5. On the Role tab, open the Privileged administrator roles section, select Owner, and click Next.
  6. On the Members tab:
    • Select User, group, or service principal.
    • Click Select members.
    • Search for the user by name or UPN.
    • Select the correct user, then click Select.
  7. Optional: Add a description such as Azure subscription owner – AppDirect order #[Order Number].
  8. Click Next.
  9. On the Conditions tab, select Not constrained, unless you want to limit what roles the Owner can delegate.
  10. Click Review + assign, then click Review + assign again to confirm.

After a few moments, the new Owner will appear in the Role assignments list and can sign in to the Azure portal to begin deploying resources.

Security best practices

  • Keep the number of subscription Owners to a minimum. Microsoft recommends no more than three Owners per subscription.
  • After the initial Owner has been assigned, return to Microsoft Entra ID → Properties and set Access management for Azure resources back to No.

Verify the setup

Use the following checklist to confirm that the subscription has been successfully claimed and delegated.

  • The subscription is visible
    Confirm in: Azure portal → Subscriptions
  • The subscription name matches the AppDirect order
    Confirm in: the subscription Overview page
  • The Owner role is assigned to the correct user
    Confirm in: Subscription → Access control (IAM) → Role assignments
  • The new Owner can sign in and create a resource group
    Confirm by having the assigned user sign in to the Azure portal
  • Global Administrator elevation has been turned off
    Confirm in: Microsoft Entra ID → Properties → Access management for Azure resources = No

Troubleshooting

I am a Global Administrator, but I still cannot see the subscription

This is the most common issue. Subscriptions provisioned through AppDirect are not automatically visible to Global Administrators until access is elevated.

To resolve this:

  1. Go to Microsoft Entra ID → Properties.
  2. Set Access management for Azure resources to Yes.
  3. Click Save.
  4. Sign out and sign back in.

The subscription should then appear under Subscriptions in the Azure portal.

I receive a 403 error when opening Roles and administrators

A 403 error usually means the signed-in account is a guest user or does not have a directory-level administrative role.

To resolve this, either:

  • Sign in with an account that has the Global Administrator role, or
  • If no internal administrator is available, begin an administrative takeover process with Microsoft to regain control of the tenant.

No one in our organization has Global Administrator access

If your organization no longer has access to a Global Administrator account, contact Microsoft Azure Support or AppDirect Support and provide proof of ownership, such as:

  • Invoice information
  • Tenant ID
  • Subscription ID

Support can then guide you through the appropriate administrative takeover process to restore access to the tenant. Please reach out to our support team for assistance by either emailing us at help@appdirect.com or calling us at 833-427-7762.

The subscription appears in the wrong tenant

Use the Directory + Subscription switcher in the Azure portal to verify that you are viewing the correct tenant.

If the subscription was associated with the wrong tenant during purchase, contact AppDirect Support to have it re-associated with the correct directory.

The Owner assignment succeeded, but the new user still cannot access the subscription

If the assigned user still cannot access the subscription:

  • Have the user sign out completely and sign back in to refresh their authentication token.
  • Confirm that the role assignment was made at the subscription scope, not only at the resource group or management group level.
  • Verify that the user is signing in with the exact same UPN that received the role assignment.

Summary

To claim an Azure subscription purchased through AppDirect, a Global Administrator must first elevate access in Microsoft Entra ID, locate the subscription in Azure, and assign the Owner role to the appropriate user. After access is confirmed, remove the temporary elevation setting to follow security best practices.

 

Related articles

Comments

0 comments

Please sign in to leave a comment.