将 Azure 订阅关联或添加到 Azure Active Directory 租户Associate or add an Azure subscription to your Azure Active Directory tenant

Azure 订阅与 Azure Active Directory (Azure AD) 之间存在信任关系。An Azure subscription has a trust relationship with Azure Active Directory (Azure AD). 订阅信任 Azure AD 对用户、服务和设备执行身份验证。A subscription trusts Azure AD to authenticate users, services, and devices.

多个订阅可以信任同一个 Azure AD 目录。Multiple subscriptions can trust the same Azure AD directory. 每个订阅只能信任一个目录。Each subscription can only trust a single directory.

一个或多个 Azure 订阅可以与 Azure Active Directory (Azure AD) 实例建立信任关系,以便针对 Azure 服务对安全主体和设备进行身份验证和授权。One or more Azure subscriptions can establish a trust relationship with an instance of Azure Active Directory (Azure AD) in order to authenticate and authorize security principals and devices against Azure services. 订阅过期时,受信任的 Azure AD 服务实例会保留,但安全主体将失去对 Azure 资源的访问权限。When a subscription expires, the trusted instance of the Azure AD service remains, but the security principals lose access to Azure resources.

当用户注册 Azure 云服务时,系统会创建一个新的 Azure AD 租户,并使该用户成为全局管理员角色的成员。When a user signs up for a Azure cloud service, a new Azure AD tenant is created and the user is made a member of the Global Administrator role. 但是,当订阅的所有者将其订阅加入现有租户时,系统不会将该所有者分配到全局管理员角色。However, when an owner of a subscription joins their subscription to an existing tenant, the owner isn't assigned to the Global Administrator role.

所有用户都有一个用于身份验证的“主”目录。All of your users have a single home directory for authentication. 用户还可以充当其他目录中的来宾。Your users can also be guests in other directories. 可在 Azure AD 中查看每位用户的主目录和来宾目录。You can see both the home and guest directories for each user in Azure AD.

重要

将订阅与其他目录关联时,如果用户的角色是使用 Azure 基于角色的访问控制分配的,则用户将失去其访问权限。When you associate a subscription with a different directory, users that have roles assigned using Azure role-based access control lose their access. 经典订阅管理员(包括服务管理员和共同管理员)也会失去访问权限。Classic subscription administrators, including Service Administrator and Co-Administrators, also lose access.

如果将 Azure Kubernetes 服务 (AKS) 群集移到其他订阅,或者将拥有该群集的订阅移到新租户,该群集将会由于失去角色分配和服务主体权限而丢失功能。Moving your Azure Kubernetes Service (AKS) cluster to a different subscription, or moving the cluster-owning subscription to a new tenant, causes the cluster to lose functionality due to lost role assignments and service principal's rights. 有关 AKS 的详细信息,请参阅 Azure Kubernetes 服务 (AKS)For more information about AKS, see Azure Kubernetes Service (AKS).

准备阶段Before you begin

在关联或添加订阅之前,请执行以下任务:Before you can associate or add your subscription, do the following tasks:

  • 查看下述在关联或添加订阅后会发生的更改的列表,以及你可能受到的具体影响:Review the following list of changes that will occur after you associate or add your subscription, and how you might be affected:

    • 已使用 Azure RBAC 为其分配了角色的用户将失去其访问权限Users that have been assigned roles using Azure RBAC will lose their access
    • 服务管理员和共同管理员将失去其访问权限Service Administrator and Co-Administrators will lose access
    • 如果你有任何密钥保管库,这些密钥保管库将无法访问,而且你必须在关联后对其进行修复If you have any key vaults, they'll be inaccessible and you'll have to fix them after association
    • 如果对资源(例如虚拟机或逻辑应用)使用任何托管标识,则必须在关联后重新启用或重新创建这些标识If you have any managed identities for resources such as Virtual Machines or Logic Apps, you must re-enable or recreate them after the association
    • 如果拥有已注册的 Azure Stack,则将必须在关联后重新注册它If you have a registered Azure Stack, you'll have to re-register it after association
    • 有关详细信息,请参阅将 Azure 订阅转移到其他 Azure AD 目录For more information, see Transfer an Azure subscription to a different Azure AD directory.
  • 使用符合以下条件的帐户登录:Sign in using an account that:

  • 请确保未使用 Azure 云服务提供商 (CSP) 订阅(MS-AZR-0145P、MS-AZR-0146P、MS-AZR-159P)、Microsoft 内部订阅 (MS-AZR-0015P) 或 Microsoft Imagine 订阅 (MS-AZR-0144P)。Make sure you're not using an Azure Cloud Service Providers (CSP) subscription (MS-AZR-0145P, MS-AZR-0146P, MS-AZR-159P), a Microsoft Internal subscription (MS-AZR-0015P), or a Microsoft Imagine subscription (MS-AZR-0144P).

将订阅关联到目录Associate a subscription to a directory

若要将现有订阅关联到 Azure AD 目录,请执行以下步骤:To associate an existing subscription to your Azure AD directory, follow these steps:

  1. 登录,然后从 Azure 门户中的“订阅”页面选择要使用的订阅。Sign in and select the subscription you want to use from the Subscriptions page in Azure portal.

  2. 选择“更改目录”。Select Change directory.

    订阅页面,其中突出显示了“更改目录”选项

  3. 查看出现的任何警告,然后选择“更改”。Review any warnings that appear, and then select Change.

    “更改目录”页,显示要更改到的目录

    订阅目录更改后,会显示一条成功消息。After the directory is changed for the subscription, you will get a success message.

  4. 选择订阅页上的“切换目录”,转到新目录。Select Switch directories on the subscription page to go to your new directory.

    “目录切换器”页,包含示例信息

    正确显示所有内容可能需要数小时。It can take several hours for everything to show up properly. 如果时间看起来太长,请查看“全局订阅筛选器”。If it seems to be taking too long, check the Global subscription filter. 确保未隐藏移动的订阅。Make sure the moved subscription isn't hidden. 可能需要注销 Azure 门户并重新登录才能查看新目录。You may need to sign out of the Azure portal and sign back in to see the new directory.

更改订阅目录是服务级操作,不会影响订阅的账单所有权。Changing the subscription directory is a service-level operation, so it doesn't affect subscription billing ownership. 若要删除原始目录,必须将订阅的账单所有权转让给新的帐户管理员。To delete the original directory, you must transfer the subscription billing ownership to a new Account Admin.

关联后的步骤Post-association steps

将订阅关联到不同的目录后,可能需要执行以下任务来恢复操作:After you associate a subscription to a different directory, you might need to do the following tasks to resume operations:

后续步骤Next steps