learn.microsoft.com
Open in
urlscan Pro
2.20.21.215
Public Scan
Submitted URL: https://aka.ms/classicadmins
Effective URL: https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators
Submission: On March 12 via api from ZA — Scanned from IT
Effective URL: https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators
Submission: On March 12 via api from ZA — Scanned from IT
Form analysis
5 forms found in the DOMName: site-header-search-form — GET /en-us/search/
<form class="flex-grow-1" method="GET" role="search" id="ms--site-header-search-form" data-bi-name="site-header-search-form" name="site-header-search-form" aria-label="Search" action="/en-us/search/">
<div class="autocomplete display-block" data-bi-name="autocomplete"><!---->
<div class="field-body control ">
<input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="site-header-search-autocomplete-input" data-test-id="site-header-search-autocomplete-input" class="autocomplete-input input input-sm
width-full" type="search" name="terms" aria-expanded="false" aria-owns="ax-0-listbox" aria-controls="ax-0-listbox" aria-activedescendant="" aria-label="Search" aria-describedby="ms--site-header-search-autocomplete-input-description"
placeholder="Search" data-bi-name="site-header-search-autocomplete-input" pattern=".*">
<span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
<span hidden="" id="ms--site-header-search-autocomplete-input-description"> Suggestions will filter as you type </span>
</div>
<ul role="listbox" id="ax-0-listbox" data-test-id="site-header-search-autocomplete-input-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
</ul>
<!---->
</div>
<!-- mobile safari will not dispatch submit event unless there's a submit button that is not display:none -->
<button type="submit" class="visually-hidden" tabindex="-1" aria-hidden="true"></button>
<input name="category" hidden="" value="">
</form>
Name: site-header-search-form-mobile — GET /en-us/search/
<form class="flex-grow-1" method="GET" role="search" id="ms--site-header-search-form-mobile" data-bi-name="site-header-search-form-mobile" name="site-header-search-form-mobile" aria-label="Search" action="/en-us/search/">
<div class="autocomplete display-block" data-bi-name="autocomplete"><!---->
<div class="field-body control ">
<input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="site-header-search-autocomplete-input-mobile"
data-test-id="site-header-search-autocomplete-input-mobile" class="autocomplete-input input
width-full" type="search" name="terms" aria-expanded="false" aria-owns="ax-1-listbox" aria-controls="ax-1-listbox" aria-activedescendant="" aria-label="Search" aria-describedby="ms--site-header-search-autocomplete-input-mobile-description"
placeholder="Search" data-bi-name="site-header-search-autocomplete-input-mobile" pattern=".*">
<span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
<span hidden="" id="ms--site-header-search-autocomplete-input-mobile-description"> Suggestions will filter as you type </span>
</div>
<ul role="listbox" id="ax-1-listbox" data-test-id="site-header-search-autocomplete-input-mobile-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
</ul>
<!---->
</div>
<!-- mobile safari will not dispatch submit event unless there's a submit button that is not display:none -->
<button type="submit" class="visually-hidden" tabindex="-1" aria-hidden="true"></button>
<input name="category" hidden="" value="">
</form>
Name: nav-bar-search-form — GET /en-us/search/
<form class="nav-bar-search-form" method="GET" name="nav-bar-search-form" role="search" id="nav-bar-search-form" aria-label="Search" action="/en-us/search/">
<div class="autocomplete" data-bi-name="autocomplete"><!---->
<div class="field-body control ">
<input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="site-search-input" data-test-id="site-search-input" class="autocomplete-input input input-sm
" type="search" name="terms" aria-expanded="false" aria-owns="ax-188-listbox" aria-controls="ax-188-listbox" aria-activedescendant="" aria-label="Search" aria-describedby="ms--site-search-input-description" placeholder="Search" pattern=".*">
<span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
<span hidden="" id="ms--site-search-input-description"> Suggestions will filter as you type </span>
</div>
<ul role="listbox" id="ax-188-listbox" data-test-id="site-search-input-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
</ul>
<!---->
</div>
<!-- mobile safari will not dispatch submit event unless there's a submit button that is not display:none -->
<button type="submit" class="visually-hidden" tabindex="-1" aria-hidden="true"></button>
<input name="category" hidden="" value="">
</form>
Name: nav-bar-search-form — GET /en-us/search/
<form class="nav-bar-search-form" method="GET" name="nav-bar-search-form" role="search" id="nav-bar-search-form-desktop" aria-label="Search" action="/en-us/search/">
<div class="autocomplete" data-bi-name="autocomplete"><!---->
<div class="field-body control has-icons-left">
<input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="site-search-input-desktop" data-test-id="site-search-input-desktop" class="autocomplete-input input input-sm
control has-icons-left
" type="search" name="terms" aria-expanded="false" aria-owns="ax-189-listbox" aria-controls="ax-189-listbox" aria-activedescendant="" aria-label="Search" aria-describedby="ms--site-search-input-desktop-description" placeholder="Search"
pattern=".*">
<span aria-hidden="true" class="icon is-small is-left">
<span class="has-text-primary docon docon-search"></span>
</span>
<span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
<span hidden="" id="ms--site-search-input-desktop-description"> Suggestions will filter as you type </span>
</div>
<ul role="listbox" id="ax-189-listbox" data-test-id="site-search-input-desktop-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
</ul>
<!---->
</div>
<!-- mobile safari will not dispatch submit event unless there's a submit button that is not display:none -->
<button type="submit" class="visually-hidden" tabindex="-1" aria-hidden="true"></button>
<input name="category" hidden="" value="">
</form>
javascript:
<form action="javascript:" role="search" aria-label="Search" class="margin-bottom-xxs"><label class="visually-hidden" for="ax-207">Search</label>
<div class="autocomplete display-block" data-bi-name="autocomplete"><!---->
<div class="field-body control has-icons-left">
<input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="ax-207" data-test-id="ax-207" class="autocomplete-input input input-sm
control has-icons-left
width-full" type="text" aria-expanded="false" aria-owns="ax-208-listbox" aria-controls="ax-208-listbox" aria-activedescendant="" aria-describedby="ms--ax-207-description" placeholder="Filter by title" pattern=".*">
<span aria-hidden="true" class="icon is-small is-left">
<span class="has-text-primary docon docon-filter-settings"></span>
</span>
<span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
<span hidden="" id="ms--ax-207-description"> Suggestions will filter as you type </span>
</div>
<ul role="listbox" id="ax-208-listbox" data-test-id="ax-207-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
</ul>
<!---->
</div>
</form>
Text Content
Skip to main content We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies Accept Reject Manage cookies This browser is no longer supported. Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. Download Microsoft Edge More info about Internet Explorer and Microsoft Edge Learn * Discover * Documentation In-depth articles on Microsoft developer tools and technologies * Training Personalized learning paths and courses * Credentials Globally recognized, industry-endorsed credentials * Q&A Technical questions and answers moderated by Microsoft * Code Samples Code sample library for Microsoft developer tools and technologies * Assessments Interactive, curated guidance and recommendations * Shows Thousands of hours of original programming from Microsoft experts Featured assessment It's your AI learning journey Wherever you are in your AI journey, Microsoft Learn meets you where you are and helps you deepen your skills. * Product documentation * ASP.NET * Azure * Dynamics 365 * Microsoft 365 * Microsoft Edge * Microsoft Entra * Microsoft Graph * Microsoft Intune * Microsoft Purview * Microsoft Teams * .NET * Power Apps * Power Automate * Power BI * Power Platform * PowerShell * SQL * Sysinternals * Visual Studio * Windows * Windows Server View all products Featured assessment It's your AI learning journey Wherever you are in your AI journey, Microsoft Learn meets you where you are and helps you deepen your skills. * Development languages * C++ * DAX * Java * OData * OpenAPI * Power Query M * VBA Featured assessment It's your AI learning journey Wherever you are in your AI journey, Microsoft Learn meets you where you are and helps you deepen your skills. * Topics * Artificial intelligence * Compliance * DevOps * Platform engineering * Security Featured assessment It's your AI learning journey Wherever you are in your AI journey, Microsoft Learn meets you where you are and helps you deepen your skills. Suggestions will filter as you type Sign in * Profile * Settings Sign out Learn Suggestions will filter as you type Sign in * Profile * Settings Sign out Learn * Learn * Documentation * Training * Credentials * Q&A * Code Samples * Assessments * Shows * More * Documentation * Training * Credentials * Q&A * Code Samples * Assessments * Shows Suggestions will filter as you type Suggestions will filter as you type Search Sign in * Profile * Settings Sign out Azure * Products * Popular products * Azure AI Services * Azure App Service * Azure Databricks * Azure DevOps * Azure Functions * Azure Monitor * Azure Virtual Machines * Popular categories * Compute * Networking * Storage * AI & machine learning * Analytics * Databases * Security * View all products * Architecture * Cloud Adoption Framework * Well-Architected Framework * Azure Architecture Center * Develop * Python * .NET * JavaScript * Java * PowerShell * Azure CLI * View all developer resources * Learn Azure * Start your AI learning assessment * Top learning paths * Cloud concepts * AI fundamentals * Intro to generative AI * Azure Architecture fundamentals * Earn credentials * Instructor-led courses * View all training * Troubleshooting * Resources * Product overview * Latest blog posts * Pricing information * Support options * More * Products * Popular products * Azure AI Services * Azure App Service * Azure Databricks * Azure DevOps * Azure Functions * Azure Monitor * Azure Virtual Machines * Popular categories * Compute * Networking * Storage * AI & machine learning * Analytics * Databases * Security * View all products * Architecture * Cloud Adoption Framework * Well-Architected Framework * Azure Architecture Center * Develop * Python * .NET * JavaScript * Java * PowerShell * Azure CLI * View all developer resources * Learn Azure * Start your AI learning assessment * Top learning paths * Cloud concepts * AI fundamentals * Intro to generative AI * Azure Architecture fundamentals * Earn credentials * Instructor-led courses * View all training * Troubleshooting * Resources * Product overview * Latest blog posts * Pricing information * Support options 1. Portal 2. Free account Table of contents Exit focus mode Search Suggestions will filter as you type * Azure RBAC documentation * Overview * Quickstarts * Tutorials * Concepts * How-to guides * List role definitions * List role assignments * Assign roles * Delegate * Add or edit ABAC conditions * Remove role assignments * List deny assignments * Create custom roles * View activity logs * Alert on privileged role assignments * Elevate access * Classic administrators * Transfer subscription to different directory * Troubleshoot * Reference * Resources Download PDF 1. Learn 2. Azure 3. Role-based access control 1. Learn 2. Azure 3. Role-based access control Read in English Add Table of contents Read in English Add Edit Print Twitter LinkedIn Facebook Email Table of contents AZURE CLASSIC SUBSCRIPTION ADMINISTRATORS * Article * 03/08/2024 * 11 contributors Feedback IN THIS ARTICLE 1. Frequently asked questions 2. Prepare for Co-Administrators retirement 3. View classic administrators 4. Remove a Co-Administrator 5. Add a Co-Administrator 6. Add a guest user as a Co-Administrator 7. Change the Service Administrator 8. Remove the Service Administrator 9. View the Account Administrator 10. Next steps Show 6 more Important Classic resources and classic administrators will be retired on August 31, 2024. Starting April 3, 2024, you won't be able to add new Co-Administrators. This date was recently extended. Remove unnecessary Co-Administrators and use Azure RBAC for fine-grained access control. Microsoft recommends that you manage access to Azure resources using Azure role-based access control (Azure RBAC). However, if you are still using the classic deployment model, you'll need to use a classic subscription administrator role: Service Administrator and Co-Administrator. For information about how to migrate your resources from classic deployment to Resource Manager deployment, see Azure Resource Manager vs. classic deployment. This article describes how to remove or change the Co-Administrator and Service Administrator roles, and how to view the Account Administrator. FREQUENTLY ASKED QUESTIONS Will Co-Administrators lose access after August 31, 2024? * Starting on August 31, 2024, Microsoft will start the process to remove access for Co-Administrators. What is the equivalent Azure role I should assign for Co-Administrators? * Owner role at subscription scope has the equivalent access. However, Owner is a privileged administrator role and grants full access to manage Azure resources. You should consider a job function role with fewer permissions, reduce the scope, or add a condition. What should I do if I have a strong dependency on Co-Administrators? * Email ACARDeprecation@microsoft.com and describe your scenario. PREPARE FOR CO-ADMINISTRATORS RETIREMENT Use the following steps to help you prepare for the Co-Administrator role retirement. STEP 1: REVIEW YOUR CURRENT CO-ADMINISTRATORS 1. Use the Azure portal to get a list of your Co-Administrators. 2. Review the sign-in logs for your Co-Administrators to assess whether they are active users. STEP 2: REMOVE CO-ADMINISTRATORS THAT NO LONGER NEED ACCESS 1. If user is no longer in your enterprise, remove Co-Administrator. 2. If user was deleted, but their Co-Administrator assignment was not removed, remove Co-Administrator. Users that have been deleted typically include the text (User was not found in this directory). 3. After reviewing activity of user, if user is no longer active, remove Co-Administrator. STEP 3: REPLACE EXISTING CO-ADMINISTRATORS WITH JOB FUNCTION ROLES Most users don't need the same permissions as a Co-Administrator. Consider a job function role instead. 1. If a user still needs some access, determine the appropriate job function role they need. 2. Determine the scope user needs. 3. Follow steps to assign a job function role to user. 4. Remove Co-Administrator. STEP 4: REPLACE EXISTING CO-ADMINISTRATORS WITH OWNER ROLE AND CONDITIONS Some users might need more access than what a job function role can provide. If you must assign the Owner role, consider adding a condition to constrain the role assignment. 1. Assign the Owner role at subscription scope with conditions to the user. 2. Remove Co-Administrator. VIEW CLASSIC ADMINISTRATORS Follow these steps to view the Service Administrator and Co-Administrators for a subscription using the Azure portal. 1. Sign in to the Azure portal as an Owner of a subscription. 2. Open Subscriptions and select a subscription. 3. Click Access control (IAM). 4. Click the Classic administrators tab to view a list of the Co-Administrators. REMOVE A CO-ADMINISTRATOR Important Classic resources and classic administrators will be retired on August 31, 2024. Starting April 3, 2024, you won't be able to add new Co-Administrators. This date was recently extended. Remove unnecessary Co-Administrators and use Azure RBAC for fine-grained access control. Follow these steps to remove a Co-Administrator. 1. Sign in to the Azure portal as an Owner of a subscription. 2. Open Subscriptions and select a subscription. 3. Click Access control (IAM). 4. Click the Classic administrators tab to view a list of the Co-Administrators. 5. Add a check mark next to the Co-Administrator you want to remove. 6. Click Remove. 7. In the message box that appears, click Yes. ADD A CO-ADMINISTRATOR Important Classic resources and classic administrators will be retired on August 31, 2024. Starting April 3, 2024, you won't be able to add new Co-Administrators. This date was recently extended. Remove unnecessary Co-Administrators and use Azure RBAC for fine-grained access control. You only need to add a Co-Administrator if the user needs to manage Azure classic deployments by using Azure Service Management PowerShell Module. If the user only uses the Azure portal to manage the classic resources, you won’t need to add the classic administrator for the user. 1. Sign in to the Azure portal as an Owner of a subscription. 2. Open Subscriptions and select a subscription. Co-Administrators can only be assigned at the subscription scope. 3. Click Access control (IAM). 4. Click the Classic administrators tab. 5. Click Add > Add co-administrator to open the Add co-administrators pane. If the Add co-administrator option is disabled, you do not have permissions. 6. Select the user that you want to add and click Add. ADD A GUEST USER AS A CO-ADMINISTRATOR To add a guest user as a Co-Administrator, follow the same steps as in the previous Add a Co-Administrator section. The guest user must meet the following criteria: * The guest user must have a presence in your directory. This means that the user was invited to your directory and accepted the invite. For more information, about how to add a guest user to your directory, see Add Microsoft Entra B2B collaboration users in the Azure portal. Before you remove a guest user from your directory, you should first remove any role assignments for that guest user. For more information, see Remove an external user from your directory. DIFFERENCES FOR GUEST USERS Guest users that have been assigned the Co-Administrator role might see some differences as compared to member users with the Co-Administrator role. Consider the following scenario: * User A with a Microsoft Entra account (work or school account) is the Service Administrator for an Azure subscription. * User B has a Microsoft account. * User A assigns the Co-Administrator role to user B. * User B can do almost everything, but is unable to register applications or look up users in the Microsoft Entra directory. You would expect that user B could manage everything. The reason for this difference is that the Microsoft account is added to the subscription as a guest user instead of a member user. Guest users have different default permissions in Microsoft Entra ID as compared to member users. For example, member users can read other users in Microsoft Entra ID and guest users cannot. Member users can register new service principals in Microsoft Entra ID and guest users cannot. If a guest user needs to be able to perform these tasks, a possible solution is to assign the specific Microsoft Entra roles the guest user needs. For example, in the previous scenario, you could assign the Directory Readers role to read other users and assign the Application Developer role to be able to create service principals. For more information about member and guest users and their permissions, see What are the default user permissions in Microsoft Entra ID?. For more information about granting access for guest users, see Assign Azure roles to external users using the Azure portal. Note that the Azure built-in roles are different than the Microsoft Entra roles. The built-in roles don't grant any access to Microsoft Entra ID. For more information, see Understand the different roles. For information that compares member users and guest users, see What are the default user permissions in Microsoft Entra ID?. CHANGE THE SERVICE ADMINISTRATOR Only the Account Administrator can change the Service Administrator for a subscription. By default, when you sign up for an Azure subscription, the Service Administrator is the same as the Account Administrator. The user with the Account Administrator role can access the Azure portal and manage billing, but they can't cancel subscriptions. The user with the Service Administrator role has full access to the Azure portal and they can cancel subscriptions. The Account Administrator can make themself the Service Administrator. Follow these steps to change the Service Administrator in the Azure portal. 1. Make sure your scenario is supported by checking the limitations for changing the Service Administrator. 2. Sign in to the Azure portal as the Account Administrator. 3. Open Cost Management + Billing and select a subscription. 4. In the left navigation, click Properties. 5. Click Change service admin. 6. In the Edit service admin page, enter the email address for the new Service Administrator. 7. Click OK to save the change. LIMITATIONS FOR CHANGING THE SERVICE ADMINISTRATOR There can only be one Service Administrator per Azure subscription. Changing the Service Administrator will behave differently depending on whether the Account Administrator is a Microsoft account or whether it is a Microsoft Entra account (work or school account). Expand table Account Administrator account Can change the Service Administrator to a different Microsoft account? Can change the Service Administrator to a Microsoft Entra account in the same directory? Can change the Service Administrator to a Microsoft Entra account in a different directory? Microsoft account Yes No No Microsoft Entra account Yes Yes No If the Account Administrator is a Microsoft Entra account, you can change the Service Administrator to a Microsoft Entra account in the same directory, but not in a different directory. For example, abby@contoso.com can change the Service Administrator to bob@contoso.com, but cannot change the Service Administrator to john@notcontoso.com unless john@notcontoso.com has a presence in the contoso.com directory. For more information about Microsoft accounts and Microsoft Entra accounts, see What is Microsoft Entra ID?. REMOVE THE SERVICE ADMINISTRATOR To remove the Service Administrator, you must have a user who is assigned the Owner role at subscription scope without conditions to avoid orphaning the subscription. A subscription Owner has the same access as the Service Administrator. 1. Sign in to the Azure portal as an Owner of a subscription. 2. Open Subscriptions and select a subscription. 3. Click Access control (IAM). 4. Click the Classic administrators tab. 5. Add a check mark next to the Service Administrator. 6. Click Remove. 7. In the message box that appears, click Yes. VIEW THE ACCOUNT ADMINISTRATOR The Account Administrator is the user that initially signed up for the Azure subscription, and is responsible as the billing owner of the subscription. To change the Account Administrator of a subscription, see Transfer ownership of an Azure subscription to another account. Follow these steps to view the Account Administrator. 1. Sign in to the Azure portal. 2. Open Cost Management + Billing and select a subscription. 3. In the left navigation, click Properties. The Account Administrator of the subscription is displayed in the Account Admin box. NEXT STEPS * Understand the different roles * Assign Azure roles using the Azure portal * Add or change Azure subscription administrators FEEDBACK Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback. Submit and view feedback for This product This page View all page feedback -------------------------------------------------------------------------------- ADDITIONAL RESOURCES -------------------------------------------------------------------------------- Training Module Manage access to an Azure subscription by using Azure role-based access control (Azure RBAC) - Training Learn how to assign management access to a subscription by using Azure role-based access control. Certification Microsoft Certified: Azure Administrator Associate - Certifications As an Azure administrator, you should have subject matter expertise in implementing, managing, and monitoring an organization’s Microsoft Azure environment, including virtual networks, storage, compute, identity, security, and governance. English (United States) California Consumer Privacy Act (CCPA) Opt-Out Icon Your Privacy Choices Theme * Light * Dark * High contrast * Manage cookies * Previous Versions * Blog * Contribute * Privacy * Terms of Use * Trademarks * © Microsoft 2024 ADDITIONAL RESOURCES -------------------------------------------------------------------------------- Training Module Manage access to an Azure subscription by using Azure role-based access control (Azure RBAC) - Training Learn how to assign management access to a subscription by using Azure role-based access control. Certification Microsoft Certified: Azure Administrator Associate - Certifications As an Azure administrator, you should have subject matter expertise in implementing, managing, and monitoring an organization’s Microsoft Azure environment, including virtual networks, storage, compute, identity, security, and governance. IN THIS ARTICLE English (United States) California Consumer Privacy Act (CCPA) Opt-Out Icon Your Privacy Choices Theme * Light * Dark * High contrast * Manage cookies * Previous Versions * Blog * Contribute * Privacy * Terms of Use * Trademarks * © Microsoft 2024