How to Add AOBO to an Azure NCE Inbound Subscription

Overview:

This article outlines the steps to add Admin On Behalf Of (AOBO) access to an Azure NCE Inbound Subscription.

Purpose

To grant Ingram Micro delegated Admin On Behalf Of (AOBO) access to Azure NCE subscriptions as required under the Microsoft CSP program. This enables Ingram Micro to provide support by having the appropriate access. AOBO must be re-added after the subscriptions are imported to the Xvantage Platform or if access has been removed.

Scope

Global Admin rights will be needed to add Admin on Behalf of (AOBO) to the Azure NCE subscription(s).

Note: When adding AOBO, the other Indirect Provider must be removed from the Access Control (IAM) and the Foreign Principal "Owner" role deleted. Ingram Micro should be the only Indirect Provider listed.

Process:

The "Object ID" of Ingram Micro's Admin Agents Group: ObjectID: 47959bc5-1acd-41ae-bbe9-6ae67264de9e

Option 1: Using CloudShell via Azure Portal

1. Log in to https://portal.azure.com

2. Click CloudShell, then select PowerShell.

3. Run the following command:

   • New-AzRoleAssignment `

   • ObjectId '47959bc5-1acd-41ae-bbe9-6ae67264de9e' `

   • ObjectType 'ForeignGroup' `

   • RoleDefinitionName 'Owner' `

     • RoleDefinitionName - If you prefer not to assign Owner privileges, we kindly ask that you assign Ingram as a "Support Request Contributor", "Cost Management Contributor" and "Quota Request Contributor"

   • Scope '/subscriptions/<SubscriptionId>'

     • Replace <SubscriptionId> with your actual subscription ID.

4. Once completed, it will look like this:

   • New-AZRoleAssignment -ObjectId '47959bc5-1acd-41ae-bbe9-6ae67264de9e' -ObjectType 'ForeignGroup' -RoleDefinitionName 'Owner' -Scope /subscriptions/1a317aed-2ae0-467e-a97d-46ea4e51f919

5. After the Command has run, the output should look something like this:

Option 2: Bulk Assignment for Multiple Subscriptions

1. Log in to https://portal.azure.com

2. Click CloudShell, then select PowerShell. Run the following script as-is. Use this script if you’re assigning AOBO across all the subscriptions that were imported.

Connect-AzAccount

$IngramObjectId = '47959bc5-1acd-41ae-bbe9-6ae67264de9e'

$roleName = 'Owner'

Get-AzSubscription | ForEach-Object {

   $subscriptionId = $_.SubscriptionId

   Set-AzContext -SubscriptionId $subscriptionId -Force

   New-AzRoleAssignment -ObjectId $IngramObjectId `

                                                  -RoleDefinitionName $roleName `

                                                   -Scope "/subscriptions/$subscriptionId" `

                                                   -ObjectType "ForeignGroup"

   Register-AzResourceProvider -ProviderNamespace 'microsoft.costmanagementexports'

   Write-Output "Registered cost management provider for subscription: $($_.Name)"

}

Write-Output "AOBO assignment and registration complete for all subscriptions."

Subtopic 1: Verification

Process:

After executing, verify AOBO:

1. Go to Azure Portal > Subscriptions > Choose Subscription.

2. Go to Access Control (IAM) > Role Assignments.

3. Ensure you see a Foreign Principal with the Owner role assigned to: 47959bc5-1acd-41ae-bbe9-6ae67264de9e

(Ingram Micro Admin Agents Group)