Configure delegated license administration

You can delegate license administration to your customers to allow them to manage their own products and subscriptions through Cloud Commander. You enable this self-service option for a single user or a group using a platform group specific to that customer and assigning the required roles.

Requirements

  • You must be assigned the Administrators role for the tenant.

Configure delegated license administration for a customer

  1. In Cloud Commander, use the global customer selector - Customers drop-down menu to select the customer you want to configure.
  2. Create a platform group for the customer:
    1. In the left navigation, select Identity > Groups.

      If the group list is empty or you can't find a specific group, refresh the page to show the most recent data.

    2. Select New group.

    3. In the wizard, select the Platform user group type and select Next.

    4. Enter a Group name and a Description for the group, and select Next.

      A summary for the group displays. For example:

    5. Review your selections. If you need to make changes, select Back. Otherwise, select Confirm to add the new group.
    6. Select Done.

      The details for the new group display.

  3. Assign members to the group:
    1. On the group details page, go to the Members tab.
    2. Select Assign members.

    3. Select the checkbox for one or more users to add to the group and select Next.
    4. Review the list of members to add. If you need to make changes, select Back. Otherwise, select Done.

      The user(s) are added to the group and display on the members list.

  4. Assign delegated roles to the group:

    5. Three delegated roles are required: License Administrators, Product and Subscription Administrators, and Subscription Management. You must repeat this step for each of these three delegated roles.

    1. Go to the Roles tab and select Platform Roles.

    2. Select Add assignments.
    3. Use the drop-down menu to select the Role to assign to the group and select Next.

      The roles that must be assigned one at a time are: License Administrators, Product and Subscription Administrators, and Subscription Management.

    4. Confirm that the checkbox for the group is selected and select Next.
    5. Select the checkbox for delegatedaccess scope type and select Next.

    6. Review your selections. If you need to make changes, select Back. Otherwise, select Confirm and then Done.
    7. Ensure you repeat this step for all required delegated roles: License Administrators, Product and Subscription Administrators, and Subscription Management.

      8. Six roles are now assigned to the group. Three for the MSP organization and three for the customer. For example:

  5. Assign tenant roles to the group:

    Two tenant roles are required so the customer can see their users and view their Microsoft Available Licenses report: Users Reader and Partner Center Customer Reader. You must repeat this step for each of these roles.

    1. Go to the Roles tab and select Platform Roles.
    2. Select Add assignments.
    3. Use the drop-down menu to select the Role to assign to the group and select Next.

      The roles that must be assigned one at a time are: Users Reader and Partner Center Customer Reader.

    4. Confirm that the checkbox for the group is selected and select Next.
    5. Select the checkbox for tenant scope type and select Next.

    6. Review your selections. If you need to make changes, select Back. Otherwise, select Confirm and then Done.
    7. Ensure you repeat this step for all required tenant roles: Users Reader and Partner Center Customer Reader.

The customer is configured for delegated license administration. There are customer members and eight roles assigned the group.

Related articles

Updated: Nov 13, 2024