This post provides a quick introduction to the features available with Azure Active Directory Business to Business (B2B) Collaboration – currently in Public Preview. I’ll cover how to add someone outside your organisation to your Azure AD instance, as well as how to assign administrative privilege over the Azure subscription to the external partner through RBAC delegation.
Let’s kick things off by adding the external partner via the new Azure Portal. In this example the external partner is named Badger Lafarge and has an Gmail account. My Azure tenant is named Fish Eagle.
Once logged into the Azure Portal, select Azure Active Directory from the left hand menu.
Select Users and Groups from the presented options.
Select All Users
The full list of existing users will appear. Select the Add option.
Complete all the required information for the users and any additional profile and group in formation. Note that you have the ability to enter the text that will be sent into the body of the invitation email sent to the user.
You will see that in this example I have chosen to add the user to a group named MSDN Subscription Admins. This group has been delegated the Owner role to the Fish Eagle MSDN subscription. I’ll show where this is configured later in the article.
After completing the setup, select Create. At this point an invitation will be sent to the user, as shown in the example (Gmail) below.
The user then clicks on Get Started. At this point Azure will determine whether an account (either in a different Azure AD or a Microsoft Account) already exists for the user based on the email address. In my example, the user Badger Lafarge does not have any account, so one needs to be setup. This is the normal Microsoft Account process and as such I don’t need to show it here.
Note that the welcome message indicates the invitation relates to access to myapps.microsoft.com. While assigning access to apps within an Azure tenant to partners is probably the most common scenario, it is not the use case here and can be ignored.
After completing the account setup, the external partner (Badger Lafarge) is presented with the MyApps portal. This shows the B2B setup workflow has completed successfully. You can then see the partner account present in Azure AD. Note the globe icon that indicates the external status.
Now that Badger Lafarge has been set up correctly, he can log into the Azure Portal using the credentials he configured as part of the Microsoft Account creation. You can see from the following screenshot that once logged into the Azure Portal the external account (Badger) has access to the resources available in my tenant within my MSDN subscription (Fish Eagle).
With the Owner role assigned to my MSDN subscription, Badger can now do pretty much anything he wants to with my Azure resources. He can stop and start machines, delete storage accounts, create new resource groups, generally do a lot of damage and spend up large! This is by way of a warning – with great power comes great responsibility – be careful how you assign permissions and use the principle of ‘least privilege’ as you would normally.
In case you missed it earlier, not all external partners you add are automatically assign Owner rights over your subscription. That would be madness! Instead, when I created Badger as an external partner in my Azure AD I chose to add him to the MSDN Subscription Admins group. This is not a built in group. Instead it is a group I manually created within my Azure AD with the specific purpose of assigning Owner permissions over my subscription using Azure’s RBAC features. Of course I could have assigned him the Owner role directly (i.e. not using an Azure AD group), but where is the fun in that? The screenshot below shows where the Owner role assignment is configured within the Azure Portal.
That’s basically it. Once you have the external partner in your Azure AD you can do other tasks such as assignment to your Apps (exposed via the MyApps portal) and delegation within our Azure AD instance.
What I really like about the B2B feature is how easy it is to set up within the Portal. Hopefully that is clear from this blog post.