Team Services: Access with Azure Active Directory (Azure AD)

Last Update: 1/24/2017

Team Services

Want to authenticate users and control access to your Team Services account the same way that you can with Microsoft services like Office 365 and Azure? If your Team Services account was created with a Microsoft account, you can connect your Team Services account to your organization's directory (tenant) in Azure Active Directory (Azure AD). You can then sign in to Team Services with the same username and password that you use with these Microsoft services. You can also enforce policies for accessing your team's critical resources and key assets.

To use existing on-premises identities with Team Services, you can integrate on-premises directories with Azure AD by using Azure AD Connect. To switch your Team Services account to another directory, learn how to change your directory in Azure AD.

How does Azure AD control access to Team Services?

Your Team Services account authenticates users through your organization's directory so that only users who are members in that directory can get access to your Team Services account. When users are removed from your directory, for example, because they've moved elsewhere, they can't access your account anymore. Only specific Azure AD administrators can manage users in your directory, so they control who can get access to your Team Services account.

Without Azure AD, you're solely responsible for controlling Team Services account access. And all users must sign in with Microsoft accounts.

What do I need to set up an existing Team Services with Azure AD?

You'll need:

What happens to current users?

Your work in Team Services is associated with your sign-in address. After your Team Services account is connected to your directory, users will continue working seamlessly if their sign-in addresses appear in the connected directory. If they don't, you'll have to add those users to your directory. Your organization might have policies about adding users to the directory, so find out more first.

What if we can't use the same sign-in addresses? ▼

You'll have to add these users to the directory with new work or school accounts, or if they have existing work or school accounts, they can use those instead. Their work in Team Services won't be lost and will stay with their current Team Services sign-in addresses. You'll have to add them as new users to Team Services, reassign access levels, and readd them to any team projects. They can migrate work that they want to keep, except for their work history. Learn how to manage Team Services account users.

What happens to tools that use my credentials, like alternate credentials? ▼

Alternate credentials won't work anymore for tools that run outside a web browser, like the Git command line tool. You'll have to set up your credentials again for the Team Services account that you connected.

Add Team Services account users to your directory

  1. Sign in to the Azure classic portal or the Azure portal as global administrator for your organization's directory. See these topics for how to:

    Why am I asked to choose between a "work or school account" and a "personal account"?

  2. Add the sign-in addresses for all your Team Services account users to your directory, including yourself as the Team Services account owner, if not in the directory already.

    Show an example directory ▼

    Suppose Jamal is an Azure AD global administrator at Fabrikam and is in the Fabrikam directory with his work account (jamalhartnett@fabrikam.com). He's also the Team Services account owner and a user with his Microsoft account (jamalhartnett@live.com). He wants to keep his work history, so he adds his Microsoft account to the Fabrikam directory. If Jamal doesn't need his work history, he can use his work account with Team Services. But to free up the access used by his Microsoft account, he must change the Team Services account owner to his work account.

    Nicole, another user, has a work account (nicolezamora@fabrikam.com) that shares the same sign-in address with her Microsoft account, so she will continue to work seamlessly with the same sign-in address.

    Here's what the Fabrikam directory might look like in the Azure classic portal after Jamal adds users from his Team Services account.

    Directory after adding users

    More questions about setting up users?

  3. After adding your account users to your directory, connect your Team Services account to your directory.

Connect your Team Services account to your directory

  1. Sign in to the Azure classic portal with your personal Microsoft account as the Team Services account owner.

    NOTE

    You can connect your Team Services account and your directory only through the Azure classic portal.

    Why am I asked to choose between a "work or school account" and a "personal account"?

  2. If you haven't already, link your Team Services account to the Azure subscription associated with your directory.

    Why don't I see a directory when I link my account? ▼

    Directory shows a directory only when the selected Team Services account is already connected to that directory. You'll actually connect your account to a directory elsewhere and later in Azure.

    No connected directory

    What if my account is already linked to an Azure subscription?

    Important Want to use your Azure subscription to bill Team Services purchases? ▼

    You can use your linked Azure subscription to bill purchases for your Team Services account, but if your subscription has a spending limit, you must first remove this spending limit indefinitely. Learn how and why you must remove this spending limit.

  3. Go to Visual Studio Team Services. Select your Team Services account.

    Azure portal, Team Services, select your account

  4. Choose Configure > Connect.

    Configure your account

    Connect your account

  5. From the list of directories associated with the Azure subscription that's linked to your Team Services account, select the directory that you want to connect. Save your changes when you're done.

    Select your directory

    Account is now connected to your directory

    Your account is now connected to your organization's directory.

  6. To check that users can access your Team Services account, invite a user from your directory to your Team Services account and confirm that they can sign in.

  7. If you use alternate credentials with tools that run outside a web browser, like the Git command line tool, those tools won't work anymore. You must set up your credentials again for the Team Services account that you connected.

  8. If you used a Microsoft account to sign up for a Visual Studio with MSDN subscription that includes Team Services as a benefit, you can add a work or school account that's managed by Azure Active Directory to your subscription. Learn how to link work or school accounts to Visual Studio with MSDN subscriptions.

    More questions about connecting?

Next

Disconnect your Team Services account from your directory

To stop using your organization's directory and return to signing in with Microsoft accounts, you can disconnect your Team Services account from your directory.

You'll need:

  • Microsoft accounts for all users in your Team Services account, including yourself as Team Services account owner

  • Team Services account ownership for your Microsoft account

  • Global administrator permissions in your Azure AD for your Microsoft account as the Team Services account owner. You'll need both because Azure AD users can't disconnect Team Services accounts from directories. You can add Microsoft accounts to a directory as external users. Learn about managing Azure administrators.

What happens to current users?

Users will continue working seamlessly if they have Microsoft accounts that share the same sign-in addresses that they use now. Otherwise, they won't have access until you add them to Team Services as new users. They can migrate everything except work history, relink Visual Studio subscriptions, and have their access levels reassigned to their new identities.

  1. Sign in to the Azure classic portal with your Microsoft account as the Team Services account owner.

    NOTE

    You can disconnect your Team Services account from your directory only through the Azure classic portal.

    Why am I asked to choose between a work or school account and a personal account?

  2. Go to Visual Studio Team Services. Select your Team Services account.

    Select your account

  3. Chooose Configure > Disconnect.

    Configure account

    Disconnect account from directory

  4. Select None (no directory connection).

    Select no directory connection

    Account is now disconnected from your directory

    Your Team Services account is disconnected from your organization's directory. Only users with Microsoft accounts can sign in. Before you disconnect your Team Services account from your directory, make sure to change the Team Services account owner to a Microsoft account, and not to a school or work account. If you don't do this, you can't sign in to your Team Services account unless your work or school account has the same email address as your Microsoft account.

    More questions about disconnecting?

Delete users from Team Services connected to Azure AD

You can just delete the user from each Team Services account where you need to remove them. Otherwise, to remove a user from all Team Services accounts, Microsoft services, and assets that are associated with an Azure AD, delete that user from that Azure AD.

  1. Sign in to the Azure classic portal as the directory administrator in Azure.

    NOTE

    You can find the connected Azure AD only through the Azure classic portal.

  2. Go to Visual Studio Team Services. Find the Azure AD that's connected to your Team Services account.

    Find the directory connected to your account

Delete users from Azure AD

  1. Follow these steps for the Azure portal or Azure classic portal.

    Azure portal

    1. Sign in as Azure AD global administrator to the Azure portal.
    2. Follow these steps for how to delete users from your Azure AD

    Azure classic portal

    1. Sign in as Azure AD global administrator to the Azure classic portal.
    2. Go to Active Directory. Select your directory.

      Find and select the directory

    3. View the directory members.

      View directory members

    4. Delete the user.

      Delete the user from the directory

  2. Remove the user from your Team Services account and reassign their access levels, if necessary.

Q&A

General

Q: Why must I choose between a "work or school account" and my "personal account"?

A: This happens when you sign-in with an email address, like jamalhartnett@fabrikam.com, that's shared by your personal Microsoft account and by your work account or school account. Although both identities use the same sign-in address, they're still separate identities with different profiles, security settings, and permissions, so you see this screen when you sign in:

Choose work or school account, or personal Microsoft account

Q: How do I find the account owner?

If you have at least Basic access, you can find the current owner in your Team Services account settings.

  1. Go to your Team Services account settings.

    Go to account settings

  2. Under Settings, find the current owner.

    Find current owner

Add users to directory

Q: Can I switch current users from Microsoft accounts to work accounts in Team Services?

A: No, although you can add new work accounts to your Team Services account, they're treated as new users. If you want to access all your work, including its history, you must use the same sign-in addresses that you used before your Team Services account was connected to your Azure AD. You can do this by adding your Microsoft account as a member to your Azure AD.

Q: Why can't I add users from other directories to my Azure AD?

A: You must be a member or have read access in those directories. Otherwise, you can add them using B2B collaboration through your Azure AD administrator, using their Microsoft accounts, or create new work accounts for them in your directory.

Q: How do I use my work or school account with my Visual Studio with MSDN subscription?

A: If you used a Microsoft account to activate a Visual Studio with MSDN subscription that includes Team Services as a benefit, you can add a work or school account that's managed by Azure Active Directory to your subscription. Learn how to link work or school accounts to Visual Studio with MSDN subscriptions.

Q: Can I control access to my Team Services account for external users in the connected directory?

A: Yes, but only for external users who are added as guests through Office 365 or added using B2B collaboration by your Azure AD administrator. These external users are managed outside the connected directory. To learn more, contact your Azure AD administrator. The setting below doesn't affect users who are added directly to your organization's directory.

Before you start, make sure you have at least Basic access, not Stakeholder.

To control account access for external users added through Office 365 or Azure AD B2B collaboration

  1. Go to your Team Services account's control panel.

    Go to account control panel

  2. Go to your account settings. Allow or deny account access for external users added as guests.

    Change external guest access

Connect to directory

Q: Can I connect my Team Services account to an Azure AD created from Office 365?

A: Yes, but if you can't find your Office 365 Azure AD when connecting your account in the Azure portal, learn what you're missing in this FAQ: Why don't I see the directory that I want to connect?

Q: Why don't I see a directory associated with my Azure subscription?

A: You need an active and valid "full" Azure subscription, such as a "Pay-As-You-Go" subscription, associated with your organization's Azure AD and at least Co-administrator permissions for your subscription. You need both to make your directory appear in the Azure portal, so that you can link your subscription and connect your Azure AD to your Team Services account. Learn how to manage Azure subscription administrators.

Q: Why don't I see the directory that I want to connect? What should I do?

A: This might happen because:

  • Your Team Services account isn't linked to the Azure subscription that's associated with your directory. Learn how to link your Team Services account to an Azure subscription.

    Important This link also sets up account billing, so you can bill Team Services purchases to your Azure subscription. Some Azure subscriptions have a spending limit. If your Azure subscription has a spending limit, and you want to bill purchases to this subscription, you must remove this limit indefinitely. This prevents disabling your Azure subscription the next month when your monthly charges are billed. Otherwise, all resources billed to this subscription will be suspended, including all Team Services purchases, Visual Studio Marketplace purchases, and Azure resources. Learn more about how to manage your subscription's spending limit.

    If you're the subscription Account Administrator, visit the Azure Account Center to remove the spending limit:

    1. Sign in to Azure Account Center (Account > subscriptions).
    2. Select your Azure subscription.
    3. Remove your spending limit indefinitely.

Q: What if my Team Services account is already linked to an Azure subscription?

A: You can change the Azure subscription that's linked to your Team Services account. However, unlinking will cause your account to go back to the free account limits, and some users might lose access until you relink.

A: This doesn't affect your account's connection to the directory, but unlinking will cause your account to go back to the free account limits, and some users might lose access until you relink.

Q: Why is my Team Services account already connected to a directory? Can I change that directory?

A: Your Team Services account was connected to a directory when the account owner created the account or sometime after that. When you create a Team Services account with a work or school account, your Team Services account is automatically connected to the directory that manages that work or school account. You can disconnect your Team Services account from this directory and reconnect to another directory, but you might have to migrate some users.

Q: My alternate credentials don't work anymore. What do I do?

A: This happens after you connect your Team Services account to a directory. You must set up your credentials again for the account that you connected.

Q: Why can't users sign in after my Team Services account is connected to a directory?

A: Make sure their sign-in addresses are in the connected directory and in your Team Services account. If they're not directory members, and you have at least user administrator permissions, you can add them to the directory.

Some users have sign-in addresses that are shared by their Microsoft account and their work or school account. These are treated as separate identities with different profiles, security settings, and permissions. When they're asked to choose which account they want to use when they sign in, they should choose the identity that's a member in your directory because only directory members can get access to your account.

If you have a Visual Studio with MSDN subscription that includes Team Services as a benefit, and you activated that subscription with a Microsoft account, you can add a work or school account that's managed by Azure Active Directory to your subscription. Learn how to link work or school accounts to Visual Studio with MSDN subscriptions.

Disconnect from directory

Q: Why can't users sign in after my Team Services account is disconnected?

A: They must now use Microsoft accounts to sign in. They can continue working seamlessly if they have Microsoft accounts with the same sign-in addresses that they use now.

If they must create Microsoft accounts with different sign-in addresses, you must add those sign-in-addresses to your Team Services account, and reassign access to them. They can migrate work that they want to keep, except work history. They might also have to relink their MSDN subscriptions. They can use any email address to create a Microsoft account.

Q: How do I get help or support for Team Services?

A: Try the Team Services forum or Team Services Support.