Oh! No! The Azure EA portal converted my MSDN/VSTS subscription into EA subcription

I ran into a customer situation where when the customer went to the Azure Enterprise Agreement (EA) portal and made himself an account owner and then created subscriptions, his existing MSDN/VSTS based Azure subscription got converted into an Azure EA subscription. Of course this was not a great outcome.

Root Cause of this issue.

The reason this happened is because the account with which the customer had logged into the Azure EA portal was also the owner of the MSDN subscription. So, when you do this, it will give a prominent warning as below.

 

(Prior to this customer changed the “alternate account” of the MSDN/VSTS subscription to another account – but it seemed the change took time to be effective in the backend). Anyway, as mentioned before if you are logged in with the same account as the MSDN subscription account and made yourself an account owner, then all MSDN subscriptions that are tied to that account will be converted to an Azure EA subscriptions. Now in some customer environments this is perfectly OK and in some situations, customers might not want the automatic conversions and would want to maintain their MSDN subscriber benefits separate from Azure EA benefits. Both are perfectly valid, and we are discussing how to keep the separation.

Users can use their AAD credentials or MSA to activate their Visual Studio subscription. They can also add an alternate identity if needed. They can activate the monthly Azure credit they get as a benefit with that VS subscription using either identity (but they only get the monthly credit once).

When they do activate their monthly credit, they cannot also be an Account Owner on their EA. Account Owners are those people who are authorized to create Azure subscriptions tied to the EA. This EA role is unrelated to ownership of VSTS accounts and is also separate from the Owner role for an Azure subscription. EA customers who assign Visual Studio subscriptions to users using their AAD identities should avoid adding these same users as (Azure) Account Owners on their EA.

How to Prevent this: -

The best approach would instead be to have others (i.e., those who don’t have a Visual Studio subscription OR use an account that does not have a Visual Studio subscription tied to it) be added as Account Owners on the EA and for those accounts to create the Azure subscriptions needed by the development teams. Once the Azure subscription is created, the Account Owner will by default have the owner role on that Azure subscription and can add others with the owner role as well—so they could add the Visual Studio subscriber’s AAD identity as an owner on the Azure subscription and everything works end-to-end for the subscriber using their AAD identity without losing the monthly Azure credit.

Process to backtrack

Best approach if you already had caused the monthly credit benefit Azure subscription to be converted onto their EA (and thus to lose the monthly credit) is to do as follows. (Note the below requires creating a support ticket)

1)      Unassign the VS subscription from the user’s existing identity

2)      Reassign the VS subscription to a different identity for the user, an identity that is not an Account Owner on their EA.

3)      Then the user can activate their monthly Azure credit anew, using this different identity.