When managing a lot of customers with Azure Subscriptions, one possible solution of centralized management is via the Microsoft Partner Portal. Here you can manage all your CSP-customers from one place. This works really well with Microsoft 365 tenants where you just need to make sure you are registered as partner with admin rights. This, however, is not always so straight forward with Azure Subscriptions. At some point you may take over a customer or some variant of where your organization is not the original creator of the subscription. This is where the fun begins\u2026<\/p>\n\n\n\n
The Problem:<\/strong> The Solution:<\/strong> The cmdlet ran without any issue! And after logging into Partner Portal I could confirm that it actually did the trick. We can now finally get all our customers managed via the same interface.<\/p>\n\n\n\n This is what I actually did:<\/p>\n\n\n\n
Partner Portal relies on a couple of groups in your Azure AD where one is called \u201cAdminAgents\u201d to delegate admin rights to people you choose. The problem here is\u2026 it creates a role assignment in Azure only once without any real way of maintaining this relation later. Besides of PowerShell of course. After some Googling I found this article from Microsoft: https:\/\/docs.microsoft.com\/en-us\/partner-center\/revoke-reinstate-csp with some hints and tips. Tried it. It failed. Stating that \u201cThe PrincipalId ‘FFFFFfffffffFFFFFFFffff’ has type ‘ForeignGroup’ , which is different from specified PrinciaplType ‘Group’\u201d. Hmmm! Besides that funny typo at the end this error states there is something wrong either with my group or the format I\u00b4m pasting in \u2013 or something.<\/p>\n\n\n\n
I had this theory that I needed to declare something. So I looked up the cmdlet New-AzRoleAssignment in Microsoft Docs and scrolled down to a parameter called \u201c-ObjectType\u201d. I thought I could try that\u2026 It wouldn\u00b4t hurt so much, would it?!<\/p>\n\n\n\n