Q. If I am a co-administrator of an Azure subscription does that give me administrator rights over Azure AD?
A. No. Azure subscriptions and Azure AD instances are two separate entities. An Azure subscription is the container into which resources are created. An Azure subscription is associated with an Azure AD instance to enable the IDs in the Azure AD instance to be granted access to roles within the subscription. A single Azure AD instance can be associated with many subscriptions.
Azure AD has a set of roles that have administrative permissions over the Azure AD instance. Azure subscriptions have a set of roles that have administrative permissions over the subscription but these roles are separate and non-overlapping. If someone is made a co-admin of an Azure subscription that does not give the user additional Azure AD rights.
