This slides introduce best practice for Azure subscription management across contracts

1. Azure subscription management
CSP and EA
Senior Cloud Solution Architect
Daichi Isami Feb 2021

2. Why you need to learn
Azure subscription management?

3. • I mistake and charge credit into wrong contract
• I can’t find administrators
• I can’t create subscriptions
• How to collaborate EA and CSP?
• I can’t find subscriptions
Why you need to learn Azure subscription management?

4. 1. EA and CSP
2. Collaborate EA and CSP
3. What’s Azure subscription
4. Billing Calculator
5. EA to CSP migration
6. Other resources
Agenda

5. EA - Enterprise Agreement
• You can add Azure to a new or existing Enterprise Agreement by making
an upfront monetary commitment.
• You can pay for additional usage beyond the commitment, at the same
rates.
Multi Year Monetary Commitment（MYMC）
FYXX FYXX+1 FYXX+2
MC(Monetary Commitment)

6. EA - https://ea.azure.com
When you login to the EA Portal you begin in an Enrollment view for enrollment level details. Here your main
tasks are to add others in administrative roles and change any desired enrollment level settings.
You begin at the enrollment level.
The focus will be highlighted in blue
Items with a
blue pen are
editable
You can move to Department,
Account and Subscription level
You can see and add
Enterprise Admins
Hovering
over the
headshot
icon will
allow you
to see your
login
credentials
and sign out
You add
notification
contacts here
You can move
to reporting,
notifications
and help file
views on the
left hand
navigation
panel
Related
accounts is
the same as
the account
view on top
Language Selection
and Support links
are on each page
Feedback can be provided
through the comment icon
Read Only Role
Flag for those
who can see but
not edit

7. Azure Cloud Solution Provider (CSP)
Talk to your Microsoft account representative about the CSP Program
Register your interest www.MicrosoftCSP.com
Visit http://aka.ms/cloudsolutionprovider to learn more
Own and
Control the
Billing
Provision,
Manage and
Support
Sell
Integrated
Offers and
Services
Microsoft is expanding the CSP program to
more partners with access to new Azure cloud
services, more markets and new capabilities.
Own the end-to-end customer lifecycle &
relationship with direct provisioning, billing and
support of Microsoft cloud services.
Partners create the offer, set the price and
own the billing terms with their customers.
Partners can attach and/or bundle their own
services with Azure.
https://docs.microsoft.com/en-us/partner-center/regional-authorization-overview

8. CSP - https://docs.microsoft.com/partner-center/
• Create your customers on your Partner Center Portal, and you can create
and assign Azure subscriptions under the customers
• Each customers must have their Azure AD tenants to associate with your
Partner Center Portal

9. Microsoft Azure billing hierarchy
Subscription Subscription
https://ea.azure.com/
https://portal.azure.com
https://partnercenter.microsoft.com
• Azure subscriptions are created by using partnercenter.microsoft.com or
ea.azure.com
• Azure subscriptions are consumed by using portal.azure.com
Subscription Subscription
Create
Consume

10. How to take Azure subscriptions in your organization
Subscription Subscription
https://ea.azure.com/ https://partnercenter.microsoft.com
• EA- Confirm who is account administrators on your proper EA contract
• CSP - Confirm who is user Admin Agents or other proper roles on your
regional CSP contract
Subscription Subscription
Most huge customers and partners have several EA and CSP contracts
It’s quite hard to find out the administrators by Microsoft-self

11. • I mistake and charge credit into wrong contract
• Find your proper EA contract or a customer under your proper CSP in your
organization
• I can’t find administrators
• Find your administrators in your EA or CSP contracts
• I can’t create subscriptions
• Reach out EA or CSP administrators in your organization
• How to collaborate EA and CSP
• I can’t find subscriptions
Why you need to learn Azure subscription management?

12. 1. EA and CSP
2. Collaborate EA and CSP
3. What’s Azure subscription
4. Billing Calculator
5. EA to CSP migration
6. Other resources
Agenda

13. • Use Case #1: customers view
1. A customer works with multiple partners
2. A customer has own EA contract
3. A customer has their Azure Active Directory tenant
4. The partner has already established CSP contract
How to collaborate EA and CSP – use case #1 (1/3)

14. • Assign Azure subscriptions of both partners and a customer to
customer’s AAD tenant
• Retrieve all Azure subscriptions on customer’s AAD tenant
How to collaborate EA and CSP – use case #1 (2/3)
Subscription
Customer EA
Subscription
Subscription Subscription
Subscription
Subscription
Partner CSP Other Partner CSPs
Subscription
Subscription

15. • Retrieve all Azure subscriptions by assign all of them into an
AAD tenant
• Ensure isolations per partner with Azure subscription assignment
• Assign proper roles such as Owner, Reader and others by using
Role Base Access Control
How to collaborate EA and CSP – use case #1 (3/3)
https://portal.azure.com
Subscription Subscription Subscription

16. • Use Case #2: partners view
1. A partner offers their service to some customers
2. The partner has common area for the services – AD,
WSUS, SCOM and others
3. The customers have own AAD tenants
4. The partner has already established CSP contract
How to collaborate EA and CSP – use case #2 (1/2)

17. • Create subscriptions for the services per customer
• Create a subscription for common usage
• Retrieve all resources across AAD tenants with Azure Lighthouse
How to collaborate EA and CSP – use case #2 (2/2)
Partner A CSP
Subscription
(common usage)
Subscription
Subscription
Partner A - AAD tenant
Customer A - AAD tenant
Subscription
Subscription
Customer B - AAD tenant
Azure Lighthouse
RBAC – contributor, Reader…

18. • I mistake and charge credit into wrong contract
• Find your proper EA contract or a customer under your proper CSP in your
organization
• I can’t find administrators
• Find your administrator in your EA or CSP contracts
• I can’t create subscriptions
• Reach out EA or CSP administrators in your organization
• How to collaborate EA and CSP
• Design subscription architecture properly
• I can’t find subscriptions
Why you need to learn Azure subscription management?

19. 1. EA and CSP
2. Collaborate EA and CSP
3. What’s Azure subscription
4. Billing Calculator
5. EA to CSP migration
6. Other resources
Agenda

20. Subscription A
Subscription Owners
Azure AD tenants
xxxxxx@hotmail.com
xxxxx.onmicrosoft.com
xxxxxx@microsoft.com
Subscription C
microsoft.onmicrosoft.com
Subscriptions
Azure Subscription structure
Subscription B
• Subscriptions must have at least one subscription owner
• Subscriptions must have an AAD tenant
xxxxxx@gmail.com

21. Subscription A
Subscription Owners
Azure AD tenants
xxxxxx@hotmail.com
xxxxx.onmicrosoft.com
xxxxxx@microsoft.com
Subscription C
microsoft.onmicrosoft.com
Subscriptions
Azure Subscription structure
Subscription B
• Subscriptions must have at least one subscription owner
• Subscriptions must have an AAD tenant
xxxxxx@gmail.com
#1 Types of Authentication Credentials
#2 Azure Active Directory tenants
#3 Global Subscription Filter

22. #1 Types of Authentication Credentials (1/2)
Personal/Microsoft Account
• Joe.doe@hotmail.com
• Mee.too@outlook.com
• He.aswell@live.com
• tony@my_company.com
• tina@my_school.edu
• joseph@my_ngo.org
Work or school account
• tony@my_company.com
• tina@my_school.edu
• joseph@my_ngo.org
Accounts and Passwords are set by account
owner on:
http://signup.live.com
Passwords are reset on:
http://login.live.com
Accounts and Passwords are set by your company
or Active Directory Domain administrator on:
Synchronized Azure Active Directory in the Cloud
or Office 365 (See slide notes for details)

23. #1 Types of Authentication Credentials (2/2)
• Bad practice for Microsoft account #1
• A customer assign a Microsoft Account as Owner role into subscriptions
• The Microsoft Account owner left the company with MFA setting
• No one couldn’t touch the subscriptions
• Bad practice for Microsoft account #2
• A customer assign a Microsoft Account as Owner role into subscriptions
• The user has never logged in more than two years
• The service has failed because of Microsoft account activity policy
• Bad practice for Microsoft account #3
• A customer create a Microsoft account with their corporate ID ex. xxxx@my_company.com
• We can’t create such Microsoft account now…
• The customer had utilized the corporate ID Microsoft account, but it made seriously confusion
to distinguish “School or Work Account” and “Microsoft Account”

24. Azure Lighthouse view*
selected commapny01.com tenant view
selected commapny02.com tenant view
#2 Azure Active Directory tenants
• Some Azure features deeply depend on AAD tenants
• AAD tenants separation forces to switch AAD tenants
• Need to invite as “guest user” into other AAD tenants to make visible Azure subscriptions
• Azure Lighthouse enable to retrieve resources across AAD tenants*
Service Principal - 1 Service Principal - 2
company01.com
tenant
Subscription A
Subscription B
company02.com
tenant
Service Principal - 3 Service Principal - 4
Subscription C
Subscription D
*Azure Lighthouse supports for some Azure features

25. #3 Global Subscriptions Filter
• Enable filter your subscriptions with Global Subscriptions Filter
• New subscriptions might be unchecked on this filter

26. • I mistake and charge credit into wrong contract
• You need to find your proper EA or CSP contract in your organization
• I can’t find administrators
• You need to find your administrator in your EA or CSP contracts
• I can’t create subscriptions
• You need to contact to the administrator
• How to collaborate EA and CSP
• Design subscription architecture properly
• I can’t find subscriptions
• You need to confirm your AAD tenant and RBAC
Why you need to learn Azure subscription management?

27. • Choose issue type as “Subscription management”
• “Subscription management” and “Billing” are no charge
Create support tickets on Azure Portal if you can’t solve issues

28. Azure Datacenter
Subnet 1
Subnet 2
Subnet 3
Gateway
Subnet Virtual Network
VM VM
VPN Gateway
VM
• VNETs and Subnets are free
• Traffic between VNET Peering across
region or datacenter is charged
*Note Availability Zone has traffic across datacenters
Public IP is charged
• Basic Load Balancer is free
• Standard Load Balancer is charged
• VM is charged
• Disk is charged
• Azure AD users are charged
• Azure AD groups are free
VPN Gateway is charged
Network Security Group is free
Example architecture with popular Azure resources
• Find out which Azure SKU will be used in your architectures

29. Utilize Pricing calculator to estimate Azure
• Update your estimation by using example scenarios
• Add your specific Azure resources for your use cases if you need

30. 1. EA and CSP
2. Collaborate EA and CSP
3. What’s Azure subscription
4. Billing Calculator
5. EA to CSP migration
6. Other resources
Agenda

31. 1. Associate source EA subscriptions and destination CSP subscriptions into
same AAD(Azure Active Directory) tenant
2. Perform migration assessment for using Azure resources
3. Upgrade Azure classic deployment model to ARM(Azure Resource
Manager) if subscriptions are using Azure classic deployment model
4. Move resources from EA subscription into CSP subscription
EA to CSP migration steps
https://docs.microsoft.com/en-us/azure/cloud-solution-provider/migration/migration-from-ea-to-csp

32. • All subscriptions must be associated into an AAD tenant
• Change AAD tenant if it’s different between Partners and customers
• Invite operation user accounts into the AAD tenant
#1. Associate EA and CSP subscriptions into same AAD tenant

33. 1. Create Azure resources list of the subscriptions based on usage csv files
2. Confirm availability of the resources to move into CSP
• Available Azure services in Azure CSP https://docs.microsoft.com/en-us/azure/cloud-solution-
provider/overview/azure-csp-available-services
• Services that can be moved https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-
group-move-resources#services-that-can-be-moved
• Ex. Azure AD B2C isn’t available in CSP
• Ex. CSP supports VPN Gateway but you need to redeploy because VPN Gateway can’t be moved
• Classic Virtual machines and classic virtual network can’t migrate directly, and you need to recreate the
resources as ARM(Azure Service Manager). “Classic” means “Azure Service Manager” and please refer to an
article below if you’re not familiar with it.
• https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-deployment-model
• Many of Azure Marketplace resources can’t migrate directly. There are few exceptions such like “Red Hat” and
others, but please confirm them.
• https://docs.microsoft.com/en-us/azure/cloud-solution-provider/overview/azure-csp-available-services#azure-
marketplace-items-in-azure-csp
• https://azure.microsoft.com/is-is/updates/azure-marketplace-third-party-reseller-services-now-use-azure-monetary-
commitment/
3. Make your “EA to CSP migration plan”
#2. Perform migration assessment for using Azure resources

34. • If customers is still using resources that they created by using the Azure
classic deployment model, the resources must be transferred to the Azure
Resource Manager model before you move them to Azure CSP
• You need to follow steps below
• Platform-supported migration of IaaS resources from classic to Azure Resource Manager
https://docs.microsoft.com/en-us/azure/cloud-solution-provider/migration/ea-payg-to-azure-csp/ea-open-
direct-assessment
• Planning for migration of IaaS resources from classic to Azure Resource Manager
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/migration-classic-resource-manager-
plan
• Migrate IaaS resources from classic to Azure Resource Manager by using Azure PowerShell
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/migration-classic-resource-manager-ps
• Frequently asked questions about classic to Azure Resource Manager
migration https://docs.microsoft.com/en-us/azure/virtual-machines/windows/migration-classic-resource-
manager-faq
#3. Upgrade classic deployment model to ARM - optional

35. • Move your Azure resources by following an article below
• https://docs.microsoft.com/en-us/azure/cloud-solution-provider/migration/ea-payg-to-azure-csp/ea-open-
direct-arm-to-csp
#4. Move resources from target subscription to Azure CSP

36. 1. EA and CSP
2. Collaborate EA and CSP
3. What’s Azure subscription
4. Billing Calculator
5. EA to CSP migration
6. Other resources
Agenda

37. • EA:
• http://normalian.hatenablog.com/archive/category/EA%20Portal
• https://ea.azure.com
• https://channel9.msdn.com/Search?term=enterprise%20azure%20portal&lang-en=true
• CSP
• http://partnercenter.Microsoft.com
• https://channel9.msdn.com/Search?term=partner%20center%20csp&lang-en=true
• Azure Lighthouse
• https://azure.microsoft.com/en-us/blog/introducing-azure-lighthouse/
• https://docs.microsoft.com/en-us/azure/lighthouse/concepts/cross-tenant-management-
experience
• http://normalian.hatenablog.com/entry/2019/09/22/094524
Resources

38. Appendix: How to invite new user into AAD tenant
• Need two steps to enable subscriptions visible for other
organization users
1. Invite users into your Azure AD tenant
2. Assign a role into the user account
*This two steps are mandatory to access other AAD tenants subscriptions