Merge pull request #54416 from ozahran7/NEW-confirm-access-assign-roles

Taojunshen · web-flow · commit b538b982d8ca · 2026-04-28T06:33:05.000+08:00
Adding new module
diff --git a/learn-pr/achievements/confirm-access-assign-roles-badge-social.png b/learn-pr/achievements/confirm-access-assign-roles-badge-social.png
diff --git a/learn-pr/achievements/confirm-access-assign-roles-badge.svg b/learn-pr/achievements/confirm-access-assign-roles-badge.svg
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/1-introduction.yml b/learn-pr/device-partner-university/confirm-access-assign-roles/1-introduction.yml
@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.confirm-access-assign-roles.introduction
+title: Introduction
+metadata:
+  title: Introduction
+  description: This content is part of the "Confirming access and assigning roles in Surface portals" module.
+  ms.date: 04/24/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 1
+content: |
+  [!include[](includes/1-introduction.md)]
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/2-verify-whether-a-microsoft-tenant-exists.yml b/learn-pr/device-partner-university/confirm-access-assign-roles/2-verify-whether-a-microsoft-tenant-exists.yml
@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.confirm-access-assign-roles.verify-whether-a-microsoft-tenant-exists
+title: Verify whether a Microsoft tenant exists
+metadata:
+  title: Verify Whether A Microsoft Tenant Exists
+  description: This content is part of the "Confirming access and assigning roles in Surface portals" module.
+  ms.date: 04/24/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 2
+content: |
+  [!include[](includes/2-verify-whether-a-microsoft-tenant-exists.md)]
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/3-identify-the-global-administrator.yml b/learn-pr/device-partner-university/confirm-access-assign-roles/3-identify-the-global-administrator.yml
@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.confirm-access-assign-roles.identify-the-global-administrator
+title: Identify the Global Administrator
+metadata:
+  title: Identify The Global Administrator
+  description: This content is part of the "Confirming access and assigning roles in Surface portals" module.
+  ms.date: 04/24/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 2
+content: |
+  [!include[](includes/3-identify-the-global-administrator.md)]
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/4-assign-suitable-roles-for-surface-portals.yml b/learn-pr/device-partner-university/confirm-access-assign-roles/4-assign-suitable-roles-for-surface-portals.yml
@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.confirm-access-assign-roles.assign-suitable-roles-for-surface-portals
+title: Assign suitable roles for Surface Portals
+metadata:
+  title: Assign Suitable Roles For Surface Portals
+  description: This content is part of the "Confirming access and assigning roles in Surface portals" module.
+  ms.date: 04/24/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 4
+content: |
+  [!include[](includes/4-assign-suitable-roles-for-surface-portals.md)]
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/5-knowledge-check.yml b/learn-pr/device-partner-university/confirm-access-assign-roles/5-knowledge-check.yml
@@ -0,0 +1,84 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.confirm-access-assign-roles.knowledge-check
+title: Knowledge check
+metadata:
+  title: Knowledge Check
+  description: This content is part of the "Confirming access and assigning roles in Surface portals" module.
+  ms.date: 04/24/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 5
+quiz:
+  title: Check your knowledge
+  questions:
+  - content: "Why must you verify whether a Microsoft tenant already exists before creating a new one?"
+    choices:
+        - content: "Because Surface portals can only be accessed after a new tenant is created"
+          isCorrect: false
+          explanation: ""
+        - content: "Because an existing tenant already provides access to Microsoft services and portal onboarding"
+          isCorrect: true
+          explanation: ""
+        - content: "Because only partners are allowed to create Microsoft tenants"
+          isCorrect: false
+          explanation: ""
+        - content: "Because tenant validation is required only for Surface Support Portal access"
+          isCorrect: false
+          explanation: ""
+  - content: "Which role is required to assign access for the Surface Management Portal and Surface Support Portal?"
+    choices:
+        - content: "Service Support Admin"
+          isCorrect: false
+          explanation: ""
+        - content: "Billing Admin"
+          isCorrect: false
+          explanation: ""
+        - content: "Global Administrator"
+          isCorrect: true
+          explanation: ""
+        - content: "Microsoft Hardware Warranty Specialist"
+          isCorrect: false
+          explanation: ""
+  - content: "Which role is recommended for managing Surface devices across both the Surface Management Portal and Surface Support Portal?"
+    choices:
+        - content: "Global Reader"
+          isCorrect: false
+          explanation: ""
+        - content: "Service Support Admin"
+          isCorrect: false
+          explanation: ""
+        - content: "Microsoft Hardware Warranty Administrator"
+          isCorrect: true
+          explanation: ""
+        - content: "Billing Admin"
+          isCorrect: false
+          explanation: ""
+  - content: "What other role is required for Surface Management Portal access when a user is assigned as the Microsoft Hardware Warranty Administrator role?"
+    choices:
+        - content: "Service Support Admin"
+          isCorrect: false
+          explanation: ""
+        - content: "Global Reader"
+          isCorrect: true
+          explanation: ""
+        - content: "Billing Admin"
+          isCorrect: false
+          explanation: ""
+        - content: "Global Administrator"
+          isCorrect: false
+          explanation: ""
+  - content: "Which action isn't supported by the Microsoft Hardware Warranty Specialist role?"
+    choices:
+        - content: "Viewing service requests"
+          isCorrect: false
+          explanation: ""
+        - content: "Creating and managing device replacement requests"
+          isCorrect: false
+          explanation: ""
+        - content: "Adding, editing, or deleting ship-to addresses"
+          isCorrect: true
+          explanation: ""
+        - content: "Viewing their own service requests"
+          isCorrect: false
+          explanation: ""
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/6-summary.yml b/learn-pr/device-partner-university/confirm-access-assign-roles/6-summary.yml
@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.confirm-access-assign-roles.summary
+title: Summary
+metadata:
+  title: Summary
+  description: This content is part of the "Confirming access and assigning roles in Surface portals" module.
+  ms.date: 04/24/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 1
+content: |
+  [!include[](includes/6-summary.md)]
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/includes/1-introduction.md b/learn-pr/device-partner-university/confirm-access-assign-roles/includes/1-introduction.md
@@ -0,0 +1,10 @@
+This module shows how to access Surface portals, verify that your organization's Microsoft tenant meets the required prerequisites, identify the Global Administrator, and assign the roles needed to get started. By completing these steps, you can confirm that your environment is ready to manage and support Surface devices through the Surface Management Portal and Surface Support Portal.
+
+>[!NOTE]
+> This module is for partners supporting customers. Some steps require customer tenant permissions (for example, Global Administrator).
+
+## Learning objectives
+
+- Verify Microsoft tenant availability of your organization's domain.
+- Identify the Global Administrator.
+- Assign required roles to enable access to Surface Management and Support Portals.
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/includes/2-verify-whether-a-microsoft-tenant-exists.md b/learn-pr/device-partner-university/confirm-access-assign-roles/includes/2-verify-whether-a-microsoft-tenant-exists.md
@@ -0,0 +1,21 @@
+To access either Surface Management Portal or Surface Support Portal, you must validate your organization's Microsoft tenant. A Microsoft tenant is your organization's private space in Microsoft's cloud. It gives your organization access to Microsoft services like:
+
+- Microsoft 365 (Outlook, Teams, SharePoint, etc.)
+- Entra ID
+- Surface Management and Support Portals
+
+Your organization's tenant is identified by its domain name. It's where users, devices, and data are managed securely. Before creating a new tenant, you must verify that one doesn't already exist. Do the following before creating a new tenant:
+
+:::image type="content" border="true" source="../media/tenant-lookup.gif" alt-text="Animation showing tenant lookup process via Tenant Lookup tool.":::
+
+- Check if your organization has an existing tenant by visiting the [tenant validation page](https://gettenantpartitionweb.azurewebsites.net/).
+- Enter your organization's domain name to check if a tenant already exists.
+- Review the result.
+
+>[!IMPORTANT]
+> If a tenant exists, don't create a new one. Reach out to your IT team to get access to the Surface Management and Support Portal's onboarding process.
+
+If, upon using the tenant validation page, you discover that your organization already has a valid tenant, don't create a new tenant. Identify the Global Administrator and ask them to sign in and create a user account and assign the appropriate roles.
+
+>[!NOTE]
+> While validating through the Global Administrator is the recommended practice, creating a new tenant via Surface Support Portal is still an available option if needed.
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/includes/3-identify-the-global-administrator.md b/learn-pr/device-partner-university/confirm-access-assign-roles/includes/3-identify-the-global-administrator.md
@@ -0,0 +1,20 @@
+The admin centers—Microsoft 365 Admin Center (Surface Support Portal) and Intune Admin Center (Surface Management Portal)—are where administrators manage key settings. This includes assigning the user roles and permissions required to access each portal. In these admin centers, administrators assign the roles and permissions required to access each portal.
+
+Follow these steps to identify Global Admin in Microsoft 365 Admin Center:
+
+:::image type="content" border="true" source="../media/identify-global-admin.gif" alt-text="Animation showing the process of identifying the Global Admin in Microsoft 365 Admin Center.":::
+
+- Go to the Microsoft 365 Admin Center ([admin.microsoft.com](/admin.microsoft.com)).
+- Navigate to **Users** on the left-hand navigation pane, then select **Active Users** in the options bar.
+- Select **Filter**, then choose **Global Admins**.
+- Record the Global Admin contact information, then email them for access.
+
+To look up Global Admin on Intune Admin Center for Surface Management Portal:
+
+- Go to the Intune Admin Center ([intune.microsoft.com](/intune.microsoft.com)).
+- Navigate to **Users** on the left-hand navigation pane.
+- Select **Per-User MFA**.
+- In the View filter select **Global Administrators**.
+
+>[!IMPORTANT]
+> To assign access to Surface portals, you must have the Global Administrator role. If you're unable to access either of the Admin Centers or are unable to locate your Global Admin, reach out to your IT team for help with getting the appropriate access or contact information.
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/includes/4-assign-suitable-roles-for-surface-portals.md b/learn-pr/device-partner-university/confirm-access-assign-roles/includes/4-assign-suitable-roles-for-surface-portals.md
@@ -0,0 +1,42 @@
+:::image type="content" border="true" source="../media/surface-portal-roles.png" alt-text="Photo of user interacting with a Surface device while using Surface Slim Pen.":::
+
+Microsoft provides a range of built-in administrator roles designed for managing Surface devices through both the Surface Management Portal and the Surface Support Portal. These roles are tailored to facilitate efficient management and maintenance of Surface hardware within your organization. Let's review some of the available roles and the permissions that they have access to:
+
+| **Role type** | **Permissions** | **Description** |
+| :---: | :---: | :---: |
+| Global Admin | View service requests Create/manage device replacement requests Add/edit/delete ship-to addresses | Provides broad administrative control over Surface devices, but use is discouraged for specific Surface management tasks to minimize security risks. |
+| Service Support Admin | View service requests Create/manage device replacement requests | Focused role for managing service requests and device replacements without broader system access. |
+| Billing Admin | View service requests Create/manage device replacement requests Add/edit/delete ship-to addresses | Manages billing and shipping address aspects of device replacements and service requests. |
+| Global Reader | View all administrative settings and configurations across Microsoft Entra Read-only access to Microsoft 365 tenant and associated services | Perfect for audit, compliance, and oversight roles requiring view-only access to configurations and settings. |
+| Microsoft Hardware Warranty Admin | View all service requests. Create/manage device replacement requests. Add/edit/delete ship-to addresses. Read-only access to the Microsoft 365 tenant outside of the Surface Support Portal. | Best suited for managing comprehensive warranty-related tasks and service requests for Surface devices. |
+| Microsoft Hardware Warranty Specialist | View own service requests. Create/manage device replacement requests. Read-only access to the Microsoft 365 tenant outside of the Surface Support Portal. | Ideal for specialists handling specific service requests and device management tasks. |
+
+>[!NOTE]
+> To access Surface Management Portal (Intune), users assigned the Microsoft Hardware Warranty Admin or Microsoft Hardware Warranty Specialist role must also be assigned the Read Only Operator role.
+
+To assign new roles to users:
+
+- Open the necessary Admin Center (Microsoft 365 Admin Center for Surface Support Portal, Intune Admin Center for Surface Management Portal).
+- Select **Users**.
+- Select **Active Users**.
+- Select **Manage Roles**.
+
+A recommended role for access to both portals is the Microsoft Hardware Warranty Administrator role. This role is suited for overseeing the comprehensive management of Surface devices—granting access to view all support requests, service orders, and updating shipping and billing addresses. These functions are all crucial for overseeing the entire lifecycle of Surface device management.
+
+>[!IMPORTANT]
+> For Surface Management Portal access only, users assigned the Microsoft Hardware Warranty Administrator role must also be assigned the Global Reader role, which provides visibility into administrative settings and configurations across Microsoft Entra.
+
+Other roles that may be valuable are the Microsoft Hardware Warranty Specialist role, which allows for the creation and management of device replacement requests and a read-only view of the Microsoft 365 tenant outside of the support portals. However, this role doesn't have the ability to add, edit, or delete billing and shipping addresses.
+
+Implementing one or more of these roles ensures your team is equipped with the necessary permissions to manage Surface devices efficiently and securely. Let's review the available roles for accessing the portals and what their capabilities are:
+
+| **User roles and access level** | **View service requests** | **Create/manage device replacement requests** | **Add, edit, delete ship to addresses** |
+| :---: | :---: | :---: | :---: |
+| Global Admin | ✔️ | ✔️ | ✔️ |
+| Service Support Admin | ✔️ | ✔️ | ❌ |
+| Billing Admin | ✔️ | ✔️ | ✔️ |
+| Global Reader | ✔️ | ❌ | ❌ |
+| Microsoft Hardware Warranty Administrator | ✔️ | ✔️ | ✔️ |
+| Microsoft Hardware Warranty Specialist | ✔️ | ✔️ | ❌ |
+
+This information can help you or your IT team assign the appropriate role before proceeding with portal access. Now that you understand the key admin roles and how they unlock access to the Surface Management and Support Portals, you're ready to move forward with confidence.
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/includes/6-summary.md b/learn-pr/device-partner-university/confirm-access-assign-roles/includes/6-summary.md
@@ -0,0 +1,3 @@
+In this module, you learned how to validate your organization's Microsoft tenant, identify the Global Administrator, and assign the required administrative roles needed to access the Surface Management Portal and Surface Support Portal. These steps help ensure your environment is properly configured to begin managing and supporting Surface devices.
+
+You also explored how different administrator roles control access and capabilities across the portals, enabling your organization to assign the right permissions to the right users and confidently support the full Surface device lifecycle.
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/index.yml b/learn-pr/device-partner-university/confirm-access-assign-roles/index.yml
@@ -0,0 +1,43 @@
+### YamlMime:Module
+uid: learn.dpu.confirm-access-assign-roles
+title: Confirming access and assigning roles in Surface portals
+metadata:
+  title: Confirming Access And Assigning Roles In Surface Portals
+  description: 'In this module, you''ll learn how to confirm access and assign roles in Surface portals. You''ll understand the importance of confirming access and assigning appropriate roles to users in order to ensure a secure and efficient experience when using Surface portals.'
+  ms.date: 04/24/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: module
+  ms.service: surface
+summary: >
+  In this module, you'll learn how to confirm access and assign roles in Surface portals. You'll understand the importance of confirming access and assigning appropriate roles to users in order to ensure a secure and efficient experience when using Surface portals.
+
+abstract: |
+  By the end of this module, you'll be able to:
+  - Verify whether a Microsoft tenant exists.
+  - Identify the global administrator for a Microsoft tenant.
+  - Assign suitable roles for Surface portals.
+
+prerequisites: |
+  - None
+iconUrl: /training/achievements/confirm-access-assign-roles-badge.svg
+ratingEnabled: false
+levels:
+  - beginner
+roles:
+  - administrator
+  - business-leader
+  - business-owner
+  - business-user
+  - technology-manager
+products:
+  - surface
+units:
+  - learn.dpu.confirm-access-assign-roles.introduction
+  - learn.dpu.confirm-access-assign-roles.verify-whether-a-microsoft-tenant-exists
+  - learn.dpu.confirm-access-assign-roles.identify-the-global-administrator
+  - learn.dpu.confirm-access-assign-roles.assign-suitable-roles-for-surface-portals
+  - learn.dpu.confirm-access-assign-roles.knowledge-check
+  - learn.dpu.confirm-access-assign-roles.summary
+badge:
+  uid: learn.dpu.confirm-access-assign-roles.badge
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/media/identify-global-admin.gif b/learn-pr/device-partner-university/confirm-access-assign-roles/media/identify-global-admin.gif
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/media/surface-portal-roles.png b/learn-pr/device-partner-university/confirm-access-assign-roles/media/surface-portal-roles.png
diff --git a/learn-pr/device-partner-university/confirm-access-assign-roles/media/tenant-lookup.gif b/learn-pr/device-partner-university/confirm-access-assign-roles/media/tenant-lookup.gif
