Dell Integrated System for Microsoft Azure Stack Hub Tech Book

AAD identity store

When you use AAD for your identity store, you need two AAD accounts. These accounts can be the same account or different accounts. While using the same account might be simpler and useful if you have a limited number of Azure accounts, your business needs might require two accounts—global and billing:

• Global admin account (only required for connected deployments)—This Azure account is used to create applications and service principals for Azure Stack Hub infrastructure services in AAD. This account must have directory admin privileges to the directory under which the Azure Stack Hub system is deployed. It becomes the Global Admin for the AAD tenant. It is used:
• To provision and delegate applications and service principals for all Azure Stack Hub services that need to interact with AAD and Graph API.
• As the Service Administrator account, which owns the default provider subscription (which you can later change). You can log in to the Azure Stack Hub admin portal with this account. Use it to create offers and plans, set quotas, and perform other administrative functions in Azure Stack Hub.
• Billing account (required for both connected and disconnected deployments)—This Azure account is used to establish the billing relationship between your Azure Stack Hub system and the Azure commerce back end. This account is billed for Azure Stack Hub fees. It is also used for marketplace syndication and other hybrid scenarios.