Restoring Admin On Behalf Of (AOBO) to an Azure NCE Subscription FAQ Xvantage™

Summary:

This article describes the procedures to reinstate and grant Admin On Behalf Of (AOBO) access to an Azure NCE Subscription, along with some common questions related to this topic.

Table of Contents:

1. Why might you no longer be making any margin on an Azure subscription?

2. What is required to add Admin on Behalf Of (AOBO) to Azure NCE subscriptions?

3. Why can't the Reseller see Azure margins?

4. How do I check if Ingram Micro is listed as an AOBO?

5. What are the required prerequisites to add Ingram Micro as an Admin on Behalf Of (AOBO)?

6. What are the available options on establishing AOBO for Ingram Micro?

7. How can I verify AOBO?

8. What are the PEC Eligible Roles?

Question 1: Why might you no longer be making any margin on an Azure subscription?

Answer: You might no longer be earning a margin because the end customer might have removed Ingram Micro as their Administrator On Behalf Of (AOBO).

Question 2: What is required to add Admin on Behalf Of (AOBO) to Azure NCE subscriptions?

Answer: Global Admin rights are required to add Admin on Behalf Of (AOBO) to Azure NCE subscription(s).

Question 3: Why can't the Reseller see Azure margins?

Answer: Ingram Micro Inc. must be assigned a PEC-eligible role on every Azure NCE subscription to be eligible for Partner Earned Credit (PEC).

When an end-customer removes Ingram Micro as an AOBO, the Azure Subscription will be billed at MSRP; therefore, there is no margin to be passed to the Reseller.

Question 4: How do I check if Ingram Micro is listed as an AOBO?

Answer: The Foreign Principal role's presence, or lack thereof, can be checked under Subscription → Access control (IAM) → Roles assigned.

Question 5: What are the required prerequisites to add Ingram Micro as an Admin on Behalf Of (AOBO)?

Answer:

1. Subscription ID: It can be found in the Azure Portal: Subscriptions → Overview page.

2. End-customer's Tenant ID: It can be found in the Azure Portal: Microsoft Entra ID → Properties page.

3. "ObjectID" of Ingram Micro's AdminAgents Group: This number is static and will not change 47959bc5-1acd-41ae-bbe9-6ae67264de9e

Question 6: What are the available options on establishing AOBO for Ingram Micro?

Answer:

Option 1 - Using CloudShell via Azure Portal

1. Log in to https://portal.azure.com

2. Click CloudShell, then select PowerShell.

3. Run the following command:

   • New-AzRoleAssignment `

   • ObjectId '47959bc5-1acd-41ae-bbe9-6ae67264de9e' `

   • ObjectType 'ForeignGroup' `

   • RoleDefinitionName 'Owner' `

     • RoleDefinitionName - If you prefer not to assign Owner privileges, we kindly ask that you assign Ingram as a "Support Request Contributor", "Cost Management Contributor" and "Quota Request Contributor"

   • Scope '/subscriptions/<SubscriptionId>'

     • Replace <SubscriptionId> with your actual subscription ID.

4. Once completed, it will look like this:

   • New-AZRoleAssignment -ObjectId '47959bc5-1acd-41ae-bbe9-6ae67264de9e' -ObjectType 'ForeignGroup' -RoleDefinitionName 'Owner' -Scope /subscriptions/1a317aed-2ae0-467e-a97d-46ea4e51f919

5. After the Command has run, the output should look something like this:

   • New-AZRoleAssignment -ObjectId '47959bc5-1acd-41ae-bbe9-6ae67264de9e' -ObjectType 'ForeignGroup' -RoleDefinitionName 'Owner' -Scope /subscriptions/1a317aed-2ae0-467e-a97d-46ea4e51f919

6. After the Command has run, the output should look something like this:

Option 2 - Bulk Assignment for Multiple Subscriptions

1. Log in to https://portal.azure.com

2. Click CloudShell, then select PowerShell. Run the following script as-is. Use this script if you’re assigning AOBO across all the subscriptions that were imported.

Connect-AzAccount

$IngramObjectId = '47959bc5-1acd-41ae-bbe9-6ae67264de9e'

$roleName = 'Owner'

Get-AzSubscription | ForEach-Object {

   $subscriptionId = $_.SubscriptionId

   Set-AzContext -SubscriptionId $subscriptionId -Force

   New-AzRoleAssignment -ObjectId $IngramObjectId `

                                                  -RoleDefinitionName $roleName `

                                                   -Scope "/subscriptions/$subscriptionId" `

                                                   -ObjectType "ForeignGroup"

   Register-AzResourceProvider -ProviderNamespace 'microsoft.costmanagementexports'

   Write-Output "Registered cost management provider for subscription: $($_.Name)"

}

Write-Output "AOBO assignment and registration complete for all subscriptions."

Question 7: How can I verify AOBO?

Answer:

After executing, verify AOBO:

1. Go to Azure Portal > Subscriptions > Choose Subscription.

2. Go to Access Control (IAM) > Role Assignments.

3. Ensure you see a Foreign Principal with the Owner role assigned to: 47959bc5-1acd-41ae-bbe9-6ae67264de9e

(Ingram Micro Admin Agents Group)

Question 8: What are the PEC Eligible Roles?

Answer: Below is a list of all the Role Assignments that are Eligible for Partner Earned Credit. If you do not want to assign Ingram Micro an Owner Role, we kindly ask that you assign Ingram as both a Support Request Contributor and a Cost Management Contributor.