How to Add an Account Owner in EA Enrollment

Question

We currently have an EA Enrollment (ID: 1234567). A credit will be applied to this Enrollment, and we are planning to add a new Account Owner for this purpose. Once the credit is applied, we will also create a new tenant and subscription.

I would like to confirm the best scenario for proceeding with this setup.

• We will create the account ******@firstdomain.onmicrosoft.com in an existing tenant (Tenant A).
• This account will be added as the Account Owner for the EA Enrollment.
• Afterward, this same account (******@firstdomain.onmicrosoft.com) will be used to create a new tenant (Tenant B) as a Global Administrator.
• In Tenant B, we will create a new account ******@seconddomain.onmicrosoft.com and elevate it to Global Administrator.

Since the Account Owner account (****@firstdomain.onmicrosoft.com) belongs to Tenant A as its home directory** but is also a member of Tenant B, will this cause any issues when applying the EA credit to Tenant B?

At this point, the account created in Tenant A to be used as the Account Owner is an Azure Entra ID account that does not receive emails. This is not an issue.

However, when attempting to log in with this account, the login is successful, but an error message appears stating that access is not possible due to insufficient permissions.

How can this issue be resolved?

I apologize for any language mistakes. Also, if there is a more optimal approach, please feel free to provide recommendations.

Answer 1

Hello Yu-Jeong Seo,

Understand that you have an Account created in Tenant A to be used as the Account Owner. and you are intended to create other new Tenant and subscription with the help of this Account Owner.

In order to achieve this, you must need an Enterprise administrator role.

having the EA administrator role, you can have the following benefits.

• Manage accounts and account owners.
• Manage other enterprise administrators.
• Manage department administrators.
• Manage notification contacts.
• Purchase Azure services, including reservations/savings plans.
• View usage across all accounts.
• View unbilled charges across all accounts.
• Create new subscriptions under active enrollment accounts.
• View and manage all reservation/savings plan orders and reservations/savings plans that apply to the Enterprise Agreement.

Useful thread: https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/understand-ea-roles

You can refer to the User limit for admin roles.

https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/understand-ea-roles#user-limit-for-admin-roles

Please note you’ll need to change the authorization level of your enterprise agreement to Work or School cross tenant.

Follow the below doc to do the same.

https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/direct-ea-administration#view-and-manage-enrollment-policies

Note:

1. The enterprise administrator role can be assigned to multiple accounts.
2. the enterprise administrator assigns access to scopes for other users. As a best practice for business continuity, you should always have two users with enterprise administrator access.

Since the Account Owner account (****@firstdomain.onmicrosoft.com) belongs to Tenant A as its home directory** but is also a member of Tenant B, will this cause any issues when applying the EA credit to Tenant B?

An EA can have multiple enrollment accounts associated with multiple tenants. This means that the EA credit can be applied to different tenants as long as the account owner is associated with the tenant where the subscriptions for the account are provisioned. but you must ensure that the Account Owner account has the necessary permissions.

Hope this helps!

let us know if you have any further queries. I’m happy to assist you further.  

Please provide your valuable comments

If the comment helpful, please upvote it.

Thanks