2

I am using Redgate Data Platform Studio to transfer data from on-premise SQL Server to Azure-hosted SQL Server. This web-based application has the ability to use an Azure Storage account (for data transfer purpose) simply by logging into my company's ADFS. The web application can successfully see storage accounts inside a subscription (let's call it Subscription A) owned by my ADFS user, when I log in to my company's active directory (via ADFS). Let's call my company's AD Directory A.

I also have subscription B owned by a Microsoft account NOT related to my company's Active Directory. This subscription B is managed by another Azure AD Tenant B, with that Microsoft account as the Service Administrator & Owner. To link the two directories, I used B2B State 3 configuration described here. So in Directory B, my Directory A user shows up as Guest User with the Source=External Azure Active Directory.

For the storage accounts in Directory B, I grant the built-in role "Storage Blob Data Contributor" and "Storage Account Contributor" to the Guest User (source=external AAD Directory A). Therefore, in both Microsoft Azure Storage Explorer as well as in portal.azure.com I can see storage accounts inside Subscription B.

BUT if I log in to the Redgate application using Directory A credential (via my company's ADFS), only storage account inside Subscription A shows up in the Redgate application. I already tried giving the guest user in Directory B the following roles to the user, even at the highest Subscription B level, but no luck:

  • As Co-Administrator
  • As Contributor
  • As Storage Account Contributor
  • As Storage Blob Data Owner

My question: is this the application's limitation of not being able to access subscription in another directory (B), or is there some configuration either in directory A/B and/or subscription A/B that I need to set?

GratefulDisciple
  • 674
  • 8
  • 18

1 Answers1

0

Is this the application's limitation of not being able to access subscription in another directory?

As per my official document and my understanding you cannot assign your subscription among many directory.

As said on official document "Multiple subscriptions can trust the same Azure AD directory, but each subscription can only trust a single directory".

See the below screen shot and refer here

enter image description here

Note: When you associate a subscription to a different directory, users that have roles assigned using role-based access control (RBAC) will lose their access. Classic subscription administrators (Service Administrator and Co-Administrators) will also lose access. Please check the Important Note here

If you want to know more details please refer this docs

Md Farid Uddin Kiron
  • 16,817
  • 3
  • 17
  • 43