{"id":2719,"date":"2018-01-22T12:19:56","date_gmt":"2018-01-22T11:19:56","guid":{"rendered":"https:\/\/www.lieben.nu\/liebensraum\/?p=2719"},"modified":"2018-01-22T12:19:56","modified_gmt":"2018-01-22T11:19:56","slug":"csp-delegation-on-non-csp-azure-subscriptions","status":"publish","type":"post","link":"https:\/\/lieben.nu\/liebensraum\/2018\/01\/csp-delegation-on-non-csp-azure-subscriptions\/","title":{"rendered":"CSP delegation on non CSP azure subscriptions"},"content":{"rendered":"<p>If you&#8217;re a Cloud Solution Provider and you supply a CSP azure subscription to that tenant, your AdminAgents will have Owner access to that subscription by default. Lets say the customer also has an existing subscription (maybe a non-profit donation?).<\/p>\n<p>When you add your accounts as Owner to the existing tenant&#8217;s (non-csp) subscription, your users are added as Guest accounts in the customer&#8217;s Azure AD. This\u00a0<strong>removes<\/strong> the delegated CSP rights on the CSP subscription because the references to foreign accounts break due to the new guest accounts having the same UPN.<\/p>\n<p>So, alternatively, use<\/p>\n<pre class=\"brush: powershell; title: ; notranslate\" title=\"\">Get-AzureRmRoleAssignment -Scope &quot;\/subscriptions\/&lt;CSP SUBSCRIPTION ID&gt;<\/pre>\n<p>on the <strong>CSP<\/strong> subscription to get the Foreign Principal ID for your own tenant. Then use<\/p>\n<pre class=\"brush: powershell; title: ; notranslate\" title=\"\">New-AzureRMRoleAssignment -ObjectId &lt;FOREIGN PRINCIPAL ID&gt; -Scope &quot;\/subscriptions\/ \n&lt;EXISTING SUBSCRIPTION ID&gt;&quot; -RoleDefinitionName Owner<\/pre>\n<p>to add the foreign principal ID to the existing customer subscription to get delegated access \ud83d\ude42<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you&#8217;re a Cloud Solution Provider and you supply a CSP azure subscription to that tenant, your AdminAgents will have Owner access to that subscription by default. Lets say the customer also has an existing subscription (maybe a non-profit donation?). When you add your accounts as Owner to the existing tenant&#8217;s (non-csp) subscription, your users &hellip; <a href=\"https:\/\/lieben.nu\/liebensraum\/2018\/01\/csp-delegation-on-non-csp-azure-subscriptions\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">CSP delegation on non CSP azure subscriptions<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[5,9,39,43],"tags":[],"class_list":["post-2719","post","type-post","status-publish","format-standard","hentry","category-azure","category-csp","category-powershell","category-security"],"_links":{"self":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/2719","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/comments?post=2719"}],"version-history":[{"count":0,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/2719\/revisions"}],"wp:attachment":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/media?parent=2719"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/categories?post=2719"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/tags?post=2719"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}