- [Instructor] An Azure Active Directory administrator,
does not have access to other Active Directories,
but as a global admin, you can elevate your access
to manage other subscriptions and management groups.
And you'll do this through Azure Active Directory
and then properties.
All you need to do is simply toggle on Yes to:
Global admin can manage Azure Subscriptions
and Management Groups.
When elevated, the account will be granted
the rights of the user access administrative role
on all subscriptions.
Microsoft recommends this should only be done
as a temporary measure.
Now let's review the same procedure using PowerShell.
First, let's go ahead and get the Azure role assignment
for our user access administrator.
And we're going to do that using the Cmdlet
Get-AzureRmRoleAssignment.
We're specifying the role definition,
will equal User Access Administrator.
And for my account and we're going to
include the Scope, being the root.
Let's go ahead and run that command.
And as we can see, I am now
in the User Access Administrator group.
To remove that access, I can then use the command
Remove-AzureRmRoleAssignment followed
by the SignInName and the role definition
as well as the scope.
If I rerun Get-AzureRmRoleAssignment...
there will not be any information displayed
because I am no longer part
of the User Access Administrator group.
The key points to remember here
is that you can manage descriptions
in other management groups when you elevate access
and the account will be part
of the User Access Administrator role.