PowerShell: How to select one of multiple Active Directories in Azure

user_9271486 0
Viewed 1267

I have multiple Azure subscriptions with the same tenant, each one of them has their own Active Directory. When switching subscriptions, I still read/write to the AD of my default subscription. How can I access the other directories with PowerShell cmdlets?

Get-AzSubscription gives me this:

Name             Id                                   TenantId                             State
----             --                                   --------                             -----
Subscription 01  10000000-0000-0000-0000-000000000001 abc00000-0000-0000-0000-000000000abc Enabled
Subscription 02  20000000-0000-0000-0000-000000000002 abc00000-0000-0000-0000-000000000abc Enabled
Subscription 03  30000000-0000-0000-0000-000000000003 abc00000-0000-0000-0000-000000000abc Enabled

Now I can switch between these like this

#> Set-AzContext -SubscriptionId "20000000-0000-0000-0000-000000000002"
#> Get-AzContext

Name             Account                 SubscriptionName  Environment  TenantId
----             -------                 ----------------  -----------  --------
Subscription 02  myaccount@mydomain.com  Subscription 02   AzureCloud   abc00000-0000-0000-0000-000000000abc 

#> Set-AzContext -SubscriptionId "30000000-0000-0000-0000-000000000003"
#> Get-AzContext

Name             Account                 SubscriptionName  Environment  TenantId
----             -------                 ----------------  -----------  --------
Subscription 03  myaccount@mydomain.com  Subscription 03   AzureCloud   abc00000-0000-0000-0000-000000000abc

When using Get-AzADUser to retrieve information about a user in these subscriptions' Active Directories, it does not work - it always communicates with the AD of Subscription 01. I also tried to run Select-AzContext instead of Set-AzContext with the same result.

The ADs have completely different IDs, like 0847BCD0-0000-0000-0000-00000039C76F when looking them up in Azure portal. But could not figure out where to use them.

Could anyone please explain what I am doing wrong?

Edit: Just to illustrate this further, when executing Get-AzADUser I get the same result set no matter what subscription I have selected with Set-AzContext. There are no error messages whatsoever but I'd expect to get the users from the AD of the subscription I have selected.

azure-active-directory azure powershell
1 Answers

Within your Azure tenant you have multiple AAD tenants. The TenantId property you've listed is the id for your Azure tenant. The AAD tenant ids you can see in the portal can also be retrieved using PowerShell by running Get-AzTenant. To connect to one of these AAD tenants so that you can run commands such as Get-AzADUser add the -Tenant parameter when using Login-AzAccount, eg:

Login-AzAccount -Tenant 0847BCD0-0000-0000-0000-00000039C76F

When you run Get-AzADUser you should now get the users for that AAD tenant rather than your default AAD tenant.

user_73606350
Related