locked
Getting which Azure AD edition is running under a tenant RRS feed

  • Question

  • Hi

    Azure comes in a number of  AD Editions  .  Is there a way  say on the Admin screen or better still PowerShell to verify which edition is running under an Office 365 tenant?

    Daniel


    Collaboration Solutions Architect

    Thursday, May 12, 2016 7:53 AM

Answers

  • First off, it is important to note that a directory (aka "a tenant") may have subscriptions including both Azure AD Basic and Azure AD Premium. For tenant-level features (where they apply), the better subscription takes precedence. On user-level features, whichever license they are assigned takes precedence.

    If you have Enterprise Mobility Suite (which includes Azure AD Premium), Azure AD Premium (the stand-alone subscription) or Azure AD Basic, you'll see these listed under the 'Licenses' tab of the Azure AD section of the Azure management portal (manage.windowsazure.com):

    You should also be able to see these subscriptions listed under 'Billing > Subscriptions' in the Office admin portal:

    And finally, you can use either the Azure AD Graph API or Azure AD PowerShell to list all subscriptions. Using Azure AD Graph API (you can try this at https://graphexplorer.cloudapp.net):

    GET https://graph.windows.net/{your-tenant-id-or-domain}/subscribedSkus

    {
     "capabilityStatus": "Enabled",
          "consumedUnits": 0,
          "objectId": "5b52d803-8ef0-419d-879d-64ebb121cfba_efccb6f7-5641-4e0e-bd10-b4976e1bf68e",
          "prepaidUnits": {
            "enabled": 100,
            "suspended": 0,
            "warning": 0
          },
          "servicePlans": [
            {
              "servicePlanId": "6c57d4b6-3b23-47a5-9bc9-69f17b4947b3",
              "servicePlanName": "RMS_S_PREMIUM"
            },
            {
              "servicePlanId": "c1ec4a95-1f05-45b3-a911-aa3fa01094f5",
              "servicePlanName": "INTUNE_A"
            },
            {
              "servicePlanId": "bea4c11e-220a-4e6d-8eb8-8ea15d019f90",
              "servicePlanName": "RMS_S_ENTERPRISE"
            },
            {
              "servicePlanId": "41781fb2-bc02-4b7c-bd55-b576c07bb09d",
              "servicePlanName": "AAD_PREMIUM"
            },
            {
              "servicePlanId": "8a256a2b-b617-496d-b51b-e76466e88db0",
              "servicePlanName": "MFA_PREMIUM"
            }
          ],
          "skuId": "efccb6f7-5641-4e0e-bd10-b4976e1bf68e",
          "skuPartNumber": "EMS"
        }

    And using Azure AD PowerShell:

    PS C:\> Get-MsolSubscription
    
    ObjectId                                 SkuPartNumber                                  Status          TotalLicenses
    --------                                 -------------                                  ------          -------------
    34ee5469-752b-41fe-bed4-fca7c69b0d2f     EMS                                            Enabled         100

    The "Access to Azure AD" Azure subscription is entirely unrelated to Azure AD editions. If you go to the Office 365 portal and click "Admin" -> "Azure AD", this will take you to the Azure management portal. If you have a paid Office 365 or CRM Online subscription, you are eligible for a free Azure subscription that allows you to access the Azure AD management section of the classic Azure management portal. For this, you only need to verify a phone number. If you aren't eligible for this, you'll need to sign up for an Azure subscription, which generally requires a credit card number. Remember, this is NOT an Azure AD subscription, it's just an Azure subscription that let's you get into the Azure management portal:


    Thursday, May 12, 2016 11:44 AM

All replies

  • Technically all Editions are the same, they only differ in features.

    For example AADPremium is only a license, and so should Basic be, but I never saw this.

    You can review that on the Licenses tab of an Azure tenant in the old management portal.

    /Peter


    Peter Stapf - ExpertCircle GmbH - My blog: JustIDM.wordpress.com

    Thursday, May 12, 2016 9:49 AM
  • Peter

    Thanks for your reply. I have looked on the old management portal  and via PowerShell and  I still can't see any details pertinent to the Azure edition running under my client's tenant.  When I select The Admin-> Azure AD I am asked to fill in Credit Card details -  maybe this is an indicator that I am about to upgrade my current 'free' edition.  

    On my personal tenant, I have  MSDN subscription assigned to Azure AD. When I look at license  details, I see a message stating I ' should'  move to Azure AD Premium; so again I am not entirely sure which edition I have ;-(

    The reason for the question is I want to brand the Portal login screen for this client.

     


    Collaboration Solutions Architect


    Thursday, May 12, 2016 10:13 AM
  • From your Screenshot you should have Basic as there is no additional license listed.

    For Branding you need at least the Basic Edition:

    https://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/


    Peter Stapf - ExpertCircle GmbH - My blog: JustIDM.wordpress.com

    Thursday, May 12, 2016 10:22 AM
  • From your Screenshot you should have Basic as there is no additional license listed.

    For Branding you need at least the Basic Edition:

    https://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/


    Peter Stapf - ExpertCircle GmbH - My blog: JustIDM.wordpress.com

    Peter , 

    Therein lies the issue.  I am working with two Office 365 E1 non-profit clients and I can only assume in each case they are both assigned the (default) Azure AD free edition.  In which case how do I bump up to the basic edition and what is the likely cost?

    It maybe just a case of filling in the Credit card details - I think you don't get charged for registering Azure Web Apps .

    Daniel 


    Collaboration Solutions Architect



    Thursday, May 12, 2016 10:27 AM
  • Hi,I see.

    See "Pricing Details" on the following page:

    https://azure.microsoft.com/en-us/pricing/details/active-directory/

    There is also a Sign-in URL which leads you too a Marketplace where you can buy additional services which includes AAD Basic.

    /Peter


    Peter Stapf - ExpertCircle GmbH - My blog: JustIDM.wordpress.com

    Thursday, May 12, 2016 10:39 AM
  • This is incorrect. From that screenshot, the directory has neither Azure AD Basic, nor Azure AD Premium. This means this directory has no Azure AD subscriptions, and is therefore running with Azure AD "Free".
    Thursday, May 12, 2016 11:09 AM
  • Peter


    Thanks very much for the link.  I can see that Self-service password is supported on the free edition which is something else the client has mentioned to me.  Now this makes me think that to access Azure and Azure AD portal, we just need to add the credit card details.  Then I can see  the capabilities and map this to the likely Azure edition; prior to working out if a upgrade is required

    Daniel


    Collaboration Solutions Architect

    Thursday, May 12, 2016 11:09 AM
  • Thanks Philippe, your are right, that was a type, I mean Free of course.

    Peter Stapf - ExpertCircle GmbH - My blog: JustIDM.wordpress.com

    Thursday, May 12, 2016 11:11 AM
  • Yes SSPR is integrated in all Editions but only for Cloud Users,

    if you need to write-back PWs on-Premises you need Premium for this.

    /Peter


    Peter Stapf - ExpertCircle GmbH - My blog: JustIDM.wordpress.com

    Thursday, May 12, 2016 11:13 AM
  • Phillipe 

    Ok, so have subscription assigned to the Office 365 and subsequently the Azure tenant but not AD .  This requires and additional subscription.

    Daniel


    Collaboration Solutions Architect

    Thursday, May 12, 2016 11:13 AM
  • First off, it is important to note that a directory (aka "a tenant") may have subscriptions including both Azure AD Basic and Azure AD Premium. For tenant-level features (where they apply), the better subscription takes precedence. On user-level features, whichever license they are assigned takes precedence.

    If you have Enterprise Mobility Suite (which includes Azure AD Premium), Azure AD Premium (the stand-alone subscription) or Azure AD Basic, you'll see these listed under the 'Licenses' tab of the Azure AD section of the Azure management portal (manage.windowsazure.com):

    You should also be able to see these subscriptions listed under 'Billing > Subscriptions' in the Office admin portal:

    And finally, you can use either the Azure AD Graph API or Azure AD PowerShell to list all subscriptions. Using Azure AD Graph API (you can try this at https://graphexplorer.cloudapp.net):

    GET https://graph.windows.net/{your-tenant-id-or-domain}/subscribedSkus

    {
     "capabilityStatus": "Enabled",
          "consumedUnits": 0,
          "objectId": "5b52d803-8ef0-419d-879d-64ebb121cfba_efccb6f7-5641-4e0e-bd10-b4976e1bf68e",
          "prepaidUnits": {
            "enabled": 100,
            "suspended": 0,
            "warning": 0
          },
          "servicePlans": [
            {
              "servicePlanId": "6c57d4b6-3b23-47a5-9bc9-69f17b4947b3",
              "servicePlanName": "RMS_S_PREMIUM"
            },
            {
              "servicePlanId": "c1ec4a95-1f05-45b3-a911-aa3fa01094f5",
              "servicePlanName": "INTUNE_A"
            },
            {
              "servicePlanId": "bea4c11e-220a-4e6d-8eb8-8ea15d019f90",
              "servicePlanName": "RMS_S_ENTERPRISE"
            },
            {
              "servicePlanId": "41781fb2-bc02-4b7c-bd55-b576c07bb09d",
              "servicePlanName": "AAD_PREMIUM"
            },
            {
              "servicePlanId": "8a256a2b-b617-496d-b51b-e76466e88db0",
              "servicePlanName": "MFA_PREMIUM"
            }
          ],
          "skuId": "efccb6f7-5641-4e0e-bd10-b4976e1bf68e",
          "skuPartNumber": "EMS"
        }

    And using Azure AD PowerShell:

    PS C:\> Get-MsolSubscription
    
    ObjectId                                 SkuPartNumber                                  Status          TotalLicenses
    --------                                 -------------                                  ------          -------------
    34ee5469-752b-41fe-bed4-fca7c69b0d2f     EMS                                            Enabled         100

    The "Access to Azure AD" Azure subscription is entirely unrelated to Azure AD editions. If you go to the Office 365 portal and click "Admin" -> "Azure AD", this will take you to the Azure management portal. If you have a paid Office 365 or CRM Online subscription, you are eligible for a free Azure subscription that allows you to access the Azure AD management section of the classic Azure management portal. For this, you only need to verify a phone number. If you aren't eligible for this, you'll need to sign up for an Azure subscription, which generally requires a credit card number. Remember, this is NOT an Azure AD subscription, it's just an Azure subscription that let's you get into the Azure management portal:


    Thursday, May 12, 2016 11:44 AM
  • Philippe

    Thanks so much.  I think that is definitive answer ( which is going in my OneNote ;-) ) .  

    Thanks also to Peter for kicking off the responses to this post.

    Daniel


    Collaboration Solutions Architect

    Thursday, May 12, 2016 12:17 PM
  • Hi

    I have been briefing my client this morning regarding the various options and the various associated costs for upgrading the Azure AD Edition.  They have raised a number of questions:

    • Just to confirm that if they upgrade to E3 non profit Plan, this doesn't include Azure AD Basic or above.  I suspect this would still need an additional AD subscription
    • Non-profit Office 365 plans don't get discounts on either EMS or Azure AD subscriptions
    • We could get a limited number of Azure AD Basic subscriptions and assign these accordingly. I would want to do this with a PowerShell or maybe a FLow.

    Collaboration Solutions Architect


    Friday, May 13, 2016 8:43 AM
    • E3 does not include Azure AD Basic, no.
    • I'm not familiar with the discounts available for non-profits. Your Microsoft licensing expert would be a better person to ask.
    • Depending on what the need for Azure AD Basic is, they could assign licenses to only certain users, yes. Yes, you can use Azure AD PowerShell to assign licenses.
    Friday, May 13, 2016 11:50 AM
  • Philie

    Thanks for your reply. I think in this case I will upgrade my own tenant and show the client via one of the branded URLs, as described on Technet.  The very least I will see my company's logo even if the client decides this not needed for their tenant.

    Regards

    Daniel


    Collaboration Solutions Architect

    Monday, May 16, 2016 1:18 PM