Create an Azure subscription through Azure portal > Subscriptions > Add, following the billing flow for your agreement. Then create a resource group from Resource groups > Create, and add a directory user from Microsoft Entra ID > Users > New user. These are separate steps: subscription creation depends on your billing agreement and permissions, and creating a user does not grant that person access to Azure resources.
Before you start: check your billing agreement and roles
Subscription creation is not a universal self-service form. The available fields and required billing permissions depend on whether your account uses a Microsoft Customer Agreement (MCA) or an Enterprise Agreement (EA). Confirm your agreement and role before beginning, and follow the labels shown in your portal. See Microsoft’s MCA subscription instructions and EA subscription instructions.
As an Amazon Associate I earn from qualifying purchases.
| Agreement | Subscription-creation permissions listed by Microsoft | Billing details in the portal flow |
|---|---|---|
| Microsoft Customer Agreement (MCA) | Owner or Contributor on the invoice section, billing profile, or billing account; alternatively, Azure subscription creator on the invoice section. | Billing account, billing profile, invoice section, and Azure plan; then subscription directory, owners, and optional tags. |
| Enterprise Agreement (EA) | Enterprise Administrator or Account Owner on the enrollment account. | Billing account, enrollment account, offer type, directory, and subscription owners. |
The MCA and EA workflows use different permissions and billing fields, so do not treat one agreement’s path as interchangeable with the other.
Create the Azure subscription
- Sign in to the Azure portal and open Subscriptions.
- Select Add.
- Enter a subscription name, then complete the billing fields for your agreement. For MCA, select the billing account, billing profile, invoice section, and Azure plan. For EA, select the billing account, enrollment account, and offer type.
- Open the advanced settings and confirm the subscription directory—the Microsoft Entra tenant the subscription will use. Select the intended subscription owners. In these MCA and EA flows, owners must be users or service principals in the selected directory; guests from another directory are not selectable as subscription owners.
- Add tags if they will help you organize or manage the subscription, review the selections, and submit the creation once validation passes.
In the current-tenant MCA flow, the subscription is created immediately. If you request an MCA subscription for a different tenant, the recipient must accept the request before the subscription is created. Follow Microsoft’s MCA subscription-request steps for that case.
#1 Best Overall
Choose the subscription directory deliberately
A subscription is associated with a Microsoft Entra tenant, which supplies the identities used to authenticate and authorize access. A subscription trusts one tenant at a time, although a tenant can be associated with multiple subscriptions. Microsoft explains the relationship in Add an existing Azure subscription to your tenant and its resource-management fundamentals.
If the directory you intend to use is not available in the creation flow, stop and verify that it is the correct tenant for the subscription. Changing the directory association is a separate subscription-management decision, not a way to create an additional identity directory for the same subscription.
Create a resource group
- In the Azure portal, select Resource groups > Create.
- Choose the subscription that should contain the group.
- Enter a resource-group name and choose a location.
- Select Review + Create, check the settings, and select Create.
- Refresh the resource-group list or open the group from the creation notification.
The chosen location stores the resource-group metadata; it does not require every resource in the group to be deployed in that region. See Microsoft’s portal guide to managing resource groups.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Create a Microsoft Entra ID user
These steps create a user directly in the directory. They do not describe inviting an external guest or creating an account synchronized from on-premises identity systems.
Rank #3
- Sign in to the Azure portal with a Global Administrator or User Administrator account.
- Search for and open Microsoft Entra ID.
- Select Users > New user.
- Enter the person’s name and user name. Add group membership, a directory role, or job information if needed.
- Record the generated initial password and share it through your organization’s secure process.
- Select Create.
Microsoft’s user-creation troubleshooting guide documents the portal procedure and required roles.
Grant Azure resource access separately
A Microsoft Entra user is a directory identity, not an Azure resource permission. To access resources, the user must be in the directory associated with the subscription and receive an Azure role assignment through Azure role-based access control (Azure RBAC). Assign access at the narrowest scope that suits the task: the subscription, a resource group, or an individual resource.
Azure roles govern access to Azure resources; Microsoft Entra roles govern directory tasks such as managing directory objects. Do not assume that adding a directory role automatically grants resource access, or that creating a user automatically assigns either kind of permission. Microsoft describes the distinction in Add users and assign access to your Azure subscription.
If a step is blocked
- You cannot add a subscription: Check the billing agreement and the billing role on the relevant account, invoice section, profile, or enrollment account. Use the MCA or EA path that matches your agreement.
- The intended directory is missing: Verify that the subscription should be associated with that tenant. A subscription trusts only one Microsoft Entra tenant at a time.
- The new user cannot see resources: Confirm that the user is in the subscription’s associated directory and has an Azure RBAC assignment at the scope containing the resources.
- The subscription is for another tenant: For an MCA request, the recipient must accept it; the ordinary current-tenant creation flow does not complete that cross-tenant request.
Which signup route applies to pay-as-you-go?
Microsoft’s guidance differs by billing-account type: its EA instructions describe starting a Microsoft Online Services Program (MOSP, pay-as-you-go) subscription in the portal and completing signup at signup.azure.com, while its MCA instructions say MOSP billing accounts can no longer add subscriptions at that address. Do not treat signup.azure.com as a universal route. Identify your billing-account type and follow the current instructions for that account on Microsoft Learn.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
