Azure subscription management with EA and CSP
Download as PPTX, PDF1 like1,869 views
This document discusses Azure subscription management for Enterprise Agreements (EA) and Cloud Solution Provider (CSP) programs. It provides an overview of EA and CSP models, how to collaborate between the two, and best practices for subscription structure. Key points covered include using the correct EA or CSP contract, finding administrators, designing subscription architecture across Azure Active Directory tenants, and using tools like the Global Subscription Filter. The document also provides examples of how subscriptions can be structured for customers and partners working with both EA and CSP subscriptions.
Azure subscription management with EA and CSP
- 1. Azure subscription management CSP and EA Senior Cloud Solution Architect Daichi Isami Feb 2021
- 2. Why you need to learn Azure subscription management?
- 3. • I mistake and charge credit into wrong contract • I can’t find administrators • I can’t create subscriptions • How to collaborate EA and CSP? • I can’t find subscriptions Why you need to learn Azure subscription management?
- 4. 1. EA and CSP 2. Collaborate EA and CSP 3. What’s Azure subscription 4. Billing Calculator 5. EA to CSP migration 6. Other resources Agenda
- 5. EA - Enterprise Agreement • You can add Azure to a new or existing Enterprise Agreement by making an upfront monetary commitment. • You can pay for additional usage beyond the commitment, at the same rates. Multi Year Monetary Commitment（MYMC） FYXX FYXX+1 FYXX+2 MC(Monetary Commitment)
- 6. EA - https://ea.azure.com When you login to the EA Portal you begin in an Enrollment view for enrollment level details. Here your main tasks are to add others in administrative roles and change any desired enrollment level settings. You begin at the enrollment level. The focus will be highlighted in blue Items with a blue pen are editable You can move to Department, Account and Subscription level You can see and add Enterprise Admins Hovering over the headshot icon will allow you to see your login credentials and sign out You add notification contacts here You can move to reporting, notifications and help file views on the left hand navigation panel Related accounts is the same as the account view on top Language Selection and Support links are on each page Feedback can be provided through the comment icon Read Only Role Flag for those who can see but not edit
- 7. Azure Cloud Solution Provider (CSP) Talk to your Microsoft account representative about the CSP Program Register your interest www.MicrosoftCSP.com Visit http://aka.ms/cloudsolutionprovider to learn more Own and Control the Billing Provision, Manage and Support Sell Integrated Offers and Services Microsoft is expanding the CSP program to more partners with access to new Azure cloud services, more markets and new capabilities. Own the end-to-end customer lifecycle & relationship with direct provisioning, billing and support of Microsoft cloud services. Partners create the offer, set the price and own the billing terms with their customers. Partners can attach and/or bundle their own services with Azure. https://docs.microsoft.com/en-us/partner-center/regional-authorization-overview
- 8. CSP - https://docs.microsoft.com/partner-center/ • Create your customers on your Partner Center Portal, and you can create and assign Azure subscriptions under the customers • Each customers must have their Azure AD tenants to associate with your Partner Center Portal
- 9. Microsoft Azure billing hierarchy Subscription Subscription https://ea.azure.com/ https://portal.azure.com https://partnercenter.microsoft.com • Azure subscriptions are created by using partnercenter.microsoft.com or ea.azure.com • Azure subscriptions are consumed by using portal.azure.com Subscription Subscription Create Consume
- 10. How to take Azure subscriptions in your organization Subscription Subscription https://ea.azure.com/ https://partnercenter.microsoft.com • EA- Confirm who is account administrators on your proper EA contract • CSP - Confirm who is user Admin Agents or other proper roles on your regional CSP contract Subscription Subscription Most huge customers and partners have several EA and CSP contracts It’s quite hard to find out the administrators by Microsoft-self
- 11. • I mistake and charge credit into wrong contract • Find your proper EA contract or a customer under your proper CSP in your organization • I can’t find administrators • Find your administrators in your EA or CSP contracts • I can’t create subscriptions • Reach out EA or CSP administrators in your organization • How to collaborate EA and CSP • I can’t find subscriptions Why you need to learn Azure subscription management?
- 12. 1. EA and CSP 2. Collaborate EA and CSP 3. What’s Azure subscription 4. Billing Calculator 5. EA to CSP migration 6. Other resources Agenda
- 13. • Use Case #1: customers view 1. A customer works with multiple partners 2. A customer has own EA contract 3. A customer has their Azure Active Directory tenant 4. The partner has already established CSP contract How to collaborate EA and CSP – use case #1 (1/3)
- 14. • Assign Azure subscriptions of both partners and a customer to customer’s AAD tenant • Retrieve all Azure subscriptions on customer’s AAD tenant How to collaborate EA and CSP – use case #1 (2/3) Subscription Customer EA Subscription Subscription Subscription Subscription Subscription Partner CSP Other Partner CSPs Subscription Subscription
- 15. • Retrieve all Azure subscriptions by assign all of them into an AAD tenant • Ensure isolations per partner with Azure subscription assignment • Assign proper roles such as Owner, Reader and others by using Role Base Access Control How to collaborate EA and CSP – use case #1 (3/3) https://portal.azure.com Subscription Subscription Subscription
- 16. • Use Case #2: partners view 1. A partner offers their service to some customers 2. The partner has common area for the services – AD, WSUS, SCOM and others 3. The customers have own AAD tenants 4. The partner has already established CSP contract How to collaborate EA and CSP – use case #2 (1/2)
- 17. • Create subscriptions for the services per customer • Create a subscription for common usage • Retrieve all resources across AAD tenants with Azure Lighthouse How to collaborate EA and CSP – use case #2 (2/2) Partner A CSP Subscription (common usage) Subscription Subscription Partner A - AAD tenant Customer A - AAD tenant Subscription Subscription Customer B - AAD tenant Azure Lighthouse RBAC – contributor, Reader…
- 18. • I mistake and charge credit into wrong contract • Find your proper EA contract or a customer under your proper CSP in your organization • I can’t find administrators • Find your administrator in your EA or CSP contracts • I can’t create subscriptions • Reach out EA or CSP administrators in your organization • How to collaborate EA and CSP • Design subscription architecture properly • I can’t find subscriptions Why you need to learn Azure subscription management?
- 19. 1. EA and CSP 2. Collaborate EA and CSP 3. What’s Azure subscription 4. Billing Calculator 5. EA to CSP migration 6. Other resources Agenda
- 20. Subscription A Subscription Owners Azure AD tenants xxxxxx@hotmail.com xxxxx.onmicrosoft.com xxxxxx@microsoft.com Subscription C microsoft.onmicrosoft.com Subscriptions Azure Subscription structure Subscription B • Subscriptions must have at least one subscription owner • Subscriptions must have an AAD tenant xxxxxx@gmail.com
- 21. Subscription A Subscription Owners Azure AD tenants xxxxxx@hotmail.com xxxxx.onmicrosoft.com xxxxxx@microsoft.com Subscription C microsoft.onmicrosoft.com Subscriptions Azure Subscription structure Subscription B • Subscriptions must have at least one subscription owner • Subscriptions must have an AAD tenant xxxxxx@gmail.com #1 Types of Authentication Credentials #2 Azure Active Directory tenants #3 Global Subscription Filter
- 22. #1 Types of Authentication Credentials (1/2) Personal/Microsoft Account • Joe.doe@hotmail.com • Mee.too@outlook.com • He.aswell@live.com • tony@my_company.com • tina@my_school.edu • joseph@my_ngo.org Work or school account • tony@my_company.com • tina@my_school.edu • joseph@my_ngo.org Accounts and Passwords are set by account owner on: http://signup.live.com Passwords are reset on: http://login.live.com Accounts and Passwords are set by your company or Active Directory Domain administrator on: Synchronized Azure Active Directory in the Cloud or Office 365 (See slide notes for details)
- 23. #1 Types of Authentication Credentials (2/2) • Bad practice for Microsoft account #1 • A customer assign a Microsoft Account as Owner role into subscriptions • The Microsoft Account owner left the company with MFA setting • No one couldn’t touch the subscriptions • Bad practice for Microsoft account #2 • A customer assign a Microsoft Account as Owner role into subscriptions • The user has never logged in more than two years • The service has failed because of Microsoft account activity policy • Bad practice for Microsoft account #3 • A customer create a Microsoft account with their corporate ID ex. xxxx@my_company.com • We can’t create such Microsoft account now… • The customer had utilized the corporate ID Microsoft account, but it made seriously confusion to distinguish “School or Work Account” and “Microsoft Account”
- 24. Azure Lighthouse view* selected commapny01.com tenant view selected commapny02.com tenant view #2 Azure Active Directory tenants • Some Azure features deeply depend on AAD tenants • AAD tenants separation forces to switch AAD tenants • Need to invite as “guest user” into other AAD tenants to make visible Azure subscriptions • Azure Lighthouse enable to retrieve resources across AAD tenants* Service Principal - 1 Service Principal - 2 company01.com tenant Subscription A Subscription B company02.com tenant Service Principal - 3 Service Principal - 4 Subscription C Subscription D *Azure Lighthouse supports for some Azure features
- 25. #3 Global Subscriptions Filter • Enable filter your subscriptions with Global Subscriptions Filter • New subscriptions might be unchecked on this filter
- 26. • I mistake and charge credit into wrong contract • You need to find your proper EA or CSP contract in your organization • I can’t find administrators • You need to find your administrator in your EA or CSP contracts • I can’t create subscriptions • You need to contact to the administrator • How to collaborate EA and CSP • Design subscription architecture properly • I can’t find subscriptions • You need to confirm your AAD tenant and RBAC Why you need to learn Azure subscription management?
- 27. • Choose issue type as “Subscription management” • “Subscription management” and “Billing” are no charge Create support tickets on Azure Portal if you can’t solve issues
- 28. Azure Datacenter Subnet 1 Subnet 2 Subnet 3 Gateway Subnet Virtual Network VM VM VPN Gateway VM • VNETs and Subnets are free • Traffic between VNET Peering across region or datacenter is charged *Note Availability Zone has traffic across datacenters Public IP is charged • Basic Load Balancer is free • Standard Load Balancer is charged • VM is charged • Disk is charged • Azure AD users are charged • Azure AD groups are free VPN Gateway is charged Network Security Group is free Example architecture with popular Azure resources • Find out which Azure SKU will be used in your architectures
- 29. Utilize Pricing calculator to estimate Azure • Update your estimation by using example scenarios • Add your specific Azure resources for your use cases if you need
- 30. 1. EA and CSP 2. Collaborate EA and CSP 3. What’s Azure subscription 4. Billing Calculator 5. EA to CSP migration 6. Other resources Agenda
- 31. 1. Associate source EA subscriptions and destination CSP subscriptions into same AAD(Azure Active Directory) tenant 2. Perform migration assessment for using Azure resources 3. Upgrade Azure classic deployment model to ARM(Azure Resource Manager) if subscriptions are using Azure classic deployment model 4. Move resources from EA subscription into CSP subscription EA to CSP migration steps https://docs.microsoft.com/en-us/azure/cloud-solution-provider/migration/migration-from-ea-to-csp
- 32. • All subscriptions must be associated into an AAD tenant • Change AAD tenant if it’s different between Partners and customers • Invite operation user accounts into the AAD tenant #1. Associate EA and CSP subscriptions into same AAD tenant
- 33. 1. Create Azure resources list of the subscriptions based on usage csv files 2. Confirm availability of the resources to move into CSP • Available Azure services in Azure CSP https://docs.microsoft.com/en-us/azure/cloud-solution- provider/overview/azure-csp-available-services • Services that can be moved https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource- group-move-resources#services-that-can-be-moved • Ex. Azure AD B2C isn’t available in CSP • Ex. CSP supports VPN Gateway but you need to redeploy because VPN Gateway can’t be moved • Classic Virtual machines and classic virtual network can’t migrate directly, and you need to recreate the resources as ARM(Azure Service Manager). “Classic” means “Azure Service Manager” and please refer to an article below if you’re not familiar with it. • https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-deployment-model • Many of Azure Marketplace resources can’t migrate directly. There are few exceptions such like “Red Hat” and others, but please confirm them. • https://docs.microsoft.com/en-us/azure/cloud-solution-provider/overview/azure-csp-available-services#azure- marketplace-items-in-azure-csp • https://azure.microsoft.com/is-is/updates/azure-marketplace-third-party-reseller-services-now-use-azure-monetary- commitment/ 3. Make your “EA to CSP migration plan” #2. Perform migration assessment for using Azure resources
- 34. • If customers is still using resources that they created by using the Azure classic deployment model, the resources must be transferred to the Azure Resource Manager model before you move them to Azure CSP • You need to follow steps below • Platform-supported migration of IaaS resources from classic to Azure Resource Manager https://docs.microsoft.com/en-us/azure/cloud-solution-provider/migration/ea-payg-to-azure-csp/ea-open- direct-assessment • Planning for migration of IaaS resources from classic to Azure Resource Manager https://docs.microsoft.com/en-us/azure/virtual-machines/windows/migration-classic-resource-manager- plan • Migrate IaaS resources from classic to Azure Resource Manager by using Azure PowerShell https://docs.microsoft.com/en-us/azure/virtual-machines/windows/migration-classic-resource-manager-ps • Frequently asked questions about classic to Azure Resource Manager migration https://docs.microsoft.com/en-us/azure/virtual-machines/windows/migration-classic-resource- manager-faq #3. Upgrade classic deployment model to ARM - optional
- 35. • Move your Azure resources by following an article below • https://docs.microsoft.com/en-us/azure/cloud-solution-provider/migration/ea-payg-to-azure-csp/ea-open- direct-arm-to-csp #4. Move resources from target subscription to Azure CSP
- 36. 1. EA and CSP 2. Collaborate EA and CSP 3. What’s Azure subscription 4. Billing Calculator 5. EA to CSP migration 6. Other resources Agenda
- 37. • EA: • http://normalian.hatenablog.com/archive/category/EA%20Portal • https://ea.azure.com • https://channel9.msdn.com/Search?term=enterprise%20azure%20portal&lang-en=true • CSP • http://partnercenter.Microsoft.com • https://channel9.msdn.com/Search?term=partner%20center%20csp&lang-en=true • Azure Lighthouse • https://azure.microsoft.com/en-us/blog/introducing-azure-lighthouse/ • https://docs.microsoft.com/en-us/azure/lighthouse/concepts/cross-tenant-management- experience • http://normalian.hatenablog.com/entry/2019/09/22/094524 Resources
- 38. Appendix: How to invite new user into AAD tenant • Need two steps to enable subscriptions visible for other organization users 1. Invite users into your Azure AD tenant 2. Assign a role into the user account *This two steps are mandatory to access other AAD tenants subscriptions
Editor's Notes
- #9: https://docs.microsoft.com/en-us/partner-center/permissions-overview
- #18: https://docs.microsoft.com/en-us/partner-center/confirm-consent
- #25: Azure Lighthouse - Cross-tenant management experiences https://docs.microsoft.com/en-us/azure/lighthouse/concepts/cross-tenant-management-experience