Paul K space : Azure - Programatically Speaking

I’ve chosen automating Azure Subscription vending to start with for a number of reasons

1. To deploy a subscription is a task that requires significant privileges - so by looking at this first we’ll consider the trickiest configuration of your Service Principal

2. Deploying a subscription forces us to face the wonder that is the Billing API early on - so we can understand the hierarchy of the accounts

3. Assigning permissions for Service Principals into Billing is not standard - you’ll see nothing in the az cli for some of what we need to achieve, so we’ll also be delving into making POST requests to the Azure APIs

in fact - to provision a Subscription is one simple command…. but the journey is a hellish one.

In the Enterprise Agreement world, our org has a billing account - which should cover the entire business. Under that org we have further sub-divisions of

• locate the Billing Account detail in the portal

az billing account list 

• locate the Billing Account via CLI

At the very top-level from a licensing perspective, you can have multiple Azure Enrolments, here you can select the enrolment you want to work with. You need to be an Enterprise Administrator to access this. There can be an unlimited number of Enterprise Administrators.

Once you select the Enrolment you are working with, you then select ‘Department‘ at the top. This is where you can see all the departments in which you are the Department Administrator for and you can setup more departments which can be setup as a logical segmentation of a company or application.

• Add or Locate an appropriate department via the Portal

Within the Departments we have a number of accounts. These accounts can be seen as users that can provision azure resources under them - and they are registered under the Account - this allowing accountability and allocation logic

• Add or locate an appropriate Account to use for our service principal

az billing enrollment-account list 

• Add or locate an appropriate Account via cli

A Service Principal is created in a bare form - so it’s pretty simple to just create it and get the details. The credentials for service principal should be treated with great caution…. we intend to give this account some pretty high access!

Azure Portal

You can create a service principal (or App Registration) via the portal by selecting our AD Tenant and then App Registration from the left column.

App Registration in AAD

If we select New App - we simpy need to enter a unique name and define the scope - for our purposes simply enter the app name and select all other defaults

Add New App

we are then presented with the App Info

• Create a new Service Principal via Portal

we can use. the details here together with a generated secret from the Secrets and Certificates page

• Create a secret for a Service Principal via Portal

Azure CLI

az login
az ad sp create-for-rbac -n myAppName

will create the app and deliver the credentials

{
  "appId": "8f5f1415-aa90-40f5-9d4f-084c437592a4",
  "displayName": "deleteThisApp",
  "password": "3zN8Q~ttttttttttttttttttttttttttttt",
  "tenant": "538cf6fd-f5d4-4451-8e4a-88c34f2f2619"
}

• Create a Service Principal via CLI
• Create a secret for a Service Principal via CLI

We want our Service Principal to create new accounts - so we can either assign Global Admin to the SP - or create a Enrolment Account

Azure Portal

Global Admin should be a last resort - so using an account that has Billing Administrator role assigned, select the billing account (the overall business account) and then under accounts (on the left), create a new Account

Add an enrollment account for the SP

Azure CLI

Billing functions - well billing admin functions are pretty limited with the az cli - you’ll see alot of read functions to allow easy access to data - but no support for EA admin like this.

There are Azure Billing API commands but at the time of writing the documentation seems inconsistent and too much trouble!

To recap what we have - and where we are in the process of Automating Azure Subscriptions we have

• Created a Service Principal
• Assigned Permissions or Enrolment Account to allow subscription creation
• Have accessed the Service Principal credentials we will need when automating
• logged into az cli with our Service Principal
• created a new subscription using the az cli command

az cli sp login

to login to the az cli with a service principal we need some details from AD

username - this shows as the AppId in the Portal or via cli

password - the client secret

tenant - the tenant to which we deployed

logging in as shown below should allow access as the Principal

az login --service-principal -u "318e1b5a-6997-40e2-b707-xxxxxxxxxxxx" -p "4682ac8f-3efa-430e-b409-xxxxxxxxxxxx" --tenant "72f988bf-86f1-41af-91ab-2d7cd011db47"

you can also use the option ``--allow-no-subscriptions if you have many subscriptions under your account

az account create options

When creating the Subscription, we have only a few options - but the main one is which offer type to select

Yoiu can also supply the details of the Owner and Service Principal - but we wont for now!

az account create \
  --enrollment-account-name 
   --offer-type 
    --display-name 
    --owner-spn
    --owner-upn 

{
  "subscriptionLink": "/subscriptions/75fe2587-caee-4b85-91e3-1e2d39470db8"
}

To recap what we have - and where we are in the process of Automating Azure Subscriptions we have

• Created a Service Principal
• Assigned Permissions or Enrolment Account to allow subscription creation
• Have accessed the Service Principal credentials we will need when automating
• logged into az cli with our Service Principal
• created a new subscription using the az cli command