title: Add or change Azure admin subscription roles | Microsoft Docs

description: Describes how to add or change Azure Co-Administrator, Service Administrator and Account Administrator

ms.date: 1/23/2019

To manage access to Azure resources, you must have the appropriate administrator role. This article describes how to add or change the administrator role for a user at the subscription level.

Azure has several different roles. To manage access to resources, you can use the classic subscription administrator roles, such as Service administrator and Co-administrator, or a newer authorization system called role-based access control (RBAC). To ensure better control and to simplify access management, we recommend that you use RBAC for all access management needs. If possible, we recommend that you reconfigure existing access policies using RBAC. For more information, see [What is role-based access control (RBAC)](../role-based-access-control/overview.md) and [Understand the different roles in Azure](../role-based-access-control/rbac-and-directory-admin-roles.md).

To add someone as an administrator for an Azure subscription, assign them the [Owner](../role-based-access-control/built-in-roles.md#owner) role (an RBAC role) at the subscription scope. The Owner role can manage the resources in the subscription that you assigned and doesn't have access privilege to other subscriptions.

1. Visit [**Subscriptions** in Azure portal](https://portal.azure.com/#blade/Microsoft_Azure_Billing/SubscriptionsBlade).

2. Select the subscription that you want to give access.

3. Select **Access control (IAM)** in the list.

4. Select **Add role assignment**.

(If the Add role assignment button is missing, you do not have permission to add permissions.)

5. In the **Role** box, select **Owner**.

6. In the **Assign access to** box, select **Azure AD user, group, or service principal**.

7. In the **Select** box, type the email address of the user you want to add as Owner. Select the user, and then select **Save**.


This gives the user full access to all resources including the right to delegate access to others. To give access at a different scope, like a resource group, visit the **Access control (IAM)** blade for that scope.

Only an [Owner](../role-based-access-control/built-in-roles.md#owner) can be added as a Co-administrator. Other users with roles such as [Contributor](../role-based-access-control/built-in-roles.md#contributor) and [Reader](../role-based-access-control/built-in-roles.md#reader) cannot be added as Co-administrators.

1. If you haven't already, add someone as an Owner following instructions from above.

2. **Right-click** the Owner user you just added, and then select **Add as co-administrator**. If you do not see the **Add as co-administrator** option, refresh the page or try another Internet browser.


To remove the Co-administrator permission, **right-click** the Co-administrator user and then select **Remove co-administrator**.


- User A with an Azure AD Work or School account is a Service administrator for an Azure subscription.

- User B has a Microsoft account.

- User A assigns the Co-administrator role to user B.

- User B can do almost everything, but is unable to register applications or look up users in the Azure AD directory.

You would expect that user B could manage everything. The reason for this difference is that the Microsoft account is added to the subscription as a guest user instead of a member user. Guest users have different default permissions in Azure AD as compared to member users. For example, member users can read other users in Azure AD and guest users cannot. Member users can register new service principals in Azure AD and guest users cannot. If a guest user needs to be able to perform these tasks, a possible solution is to assign the specific Azure AD administrator roles the guest user needs. For example, in the previous scenario, you could assign the [Directory Readers](../active-directory/users-groups-roles/directory-assign-admin-roles.md#directory-readers) role to read other users and assign the [Application Developer](../active-directory/users-groups-roles/directory-assign-admin-roles.md#application-developer) role to be able to create service principals. For more information about member and guest users and their permissions, see [What are the default user permissions in Azure Active Directory?](../active-directory/fundamentals/users-default-permissions.md).

Note that the [built-in roles for Azure resources](../role-based-access-control/built-in-roles.md) are different than the [Azure AD administrator roles](../active-directory/users-groups-roles/directory-assign-admin-roles.md). The built-in roles don't grant any access to Azure AD. For more information, see [Understand the different roles](../role-based-access-control/rbac-and-directory-admin-roles.md).

Only the Account administrator can change the Service administrator for a subscription. By default, when you sign up, the Service administrator is the same as the Account administrator. If the Service administrator is changed to a different user, then the Account administrator loses access to Azure portal. However, the Account administrator can always use Account Center to change the Service administrator back to themselves.

1. Make sure your scenario is supported by checking the [limits for changing Service administrators](#limits).

1. Sign in to [Account Center](https://account.windowsazure.com/subscriptions) as the Account administrator.

1. Select a subscription.

1. On the right side, select **Edit subscription details**.


1. In the **SERVICE ADMINISTRATOR** box, enter the email address of the new Service administrator.


<a name="limits"></a>

* Each subscription is associated with an Azure AD directory. To find the directory the subscription is associated with, go to [**Subscriptions**](https://portal.azure.com/#blade/Microsoft_Azure_Billing/SubscriptionsBlade), then select a subscription to see the directory.

* If you are signed in with a Work or School account, you can add other accounts in your organization as Service administrator. For example, abby@contoso.com can add bob@contoso.com as Service administrator, but can't add john@notcontoso.com unless john@notcontoso.com has presence in the contoso.com directory. Users signed in with Work or School accounts can continue to add Microsoft Account users as Service administrator.

| Sign-in Method | Add Microsoft Account user as a Service administrator? | Add Work or School account in the same organization as a Service administrator? | Add Work or School account in different organization as a Service administrator? |

| --- | --- | --- | --- |

| Microsoft Account |Yes |No |No |

| Work or School Account |Yes |Yes |No |

The Account administrator is the user that initially signed up for the Azure subscription, and is responsible as the billing owner of the subscription. To change the Account administrator of a subscription, see [Transfer ownership of an Azure subscription to another account](billing-subscription-transfer.md).

<a name="check-the-account-administrator-of-the-subscription"></a>

1. Visit [**Subscriptions** in Azure portal](https://portal.azure.com/#blade/Microsoft_Azure_Billing/SubscriptionsBlade).

1. Select the subscription you want to check, and then look under **Settings**.

1. Select **Properties**. The Account administrator of the subscription is displayed in the **Account Admin** box.

* To learn more about RBAC, see [What is role-based access control (RBAC)?](../role-based-access-control/overview.md)

* To learn more about all the roles in Azure, see [Understand the different roles in Azure](../role-based-access-control/rbac-and-directory-admin-roles.md).

* For more information about Azure Active Directory, see [How Azure subscriptions are associated with Azure Active Directory](../active-directory/active-directory-how-subscriptions-associated-directory.md) and [Assigning administrator roles in Azure Active Directory](../active-directory/users-groups-roles/directory-assign-admin-roles.md).

If you have questions or need help, [create a support request](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportrequest).

* [Account administrator's email address](billing-add-change-azure-subscription-administrator.md#check-the-account-administrator-of-the-subscription)