Partner Admin Link
Microsoft-managed partners can configure Partner Admin Link for recognition of their influence in customer accounts.
Overview
Partner Admin Link is an important mechanism for Microsoft to recognise the influence and impact that partners to bring to their customers on Azure.
At a surface level it is a simple mechanism. If you have a) have access to a customer environment, b) create a Partner Admin Link for your identity, and c) that identity has eligible RBAC role assignments, then the usage telemetry - which is always being collected for billing purposes - is also associated to your Partner ID. Here we cover the theory in more detail, and cover multiple scenarios that I have seen in my time working with - and for - Azure partners.
Understanding PAL
Learn about Partner Admin Link, why it's important, how it works, and your options.
Service principals with credentials
Do you need to create a Partner Admin Link for a service principal? And it has eligible RBAC role assignments? Can you authenticate using its secret or certificate? If so, follow this guide.
PAL tagging with a service principal
There are a number of scenarios where you may not have eligible permanent access, and your recognition is being understated. We'll look at creating a new service principal purely for recognition purposes.
CI/CD pipelines & OpenID Connect
Pipelines or workflows commonly use service principals. Authenticating these securely using OpenID Connect is recommended to avoid the use of secrets or certificates. Here we show how to use a dedicated workflow to create the Partner Admin Link.
Using AzAPI in Terraform
Here is an example Terraform config to create the Partner Admin Link using azapi_resource_action, useful in CI/CD and subscription vending machine situations.
User and guest IDs
If you are have a user ID in a customer tenant then follow this page to configure Partner Admin Link. This is the primary use case covered in the Microsoft Learn docs but included here for completeness.
Azure Lighthouse & PAL
Combining Partner Admin Link with Azure Lighthouse reduces some of the administrative overhead. How does it differ compared to more traditional PAL configurations?
PAL FAQ
The Understanding PAL page helps to answer most of your questions on Partner Admin Link. Here you'll find a link to the main Microsoft FAQ for PAL, plus an option to ask more questions here.
The pages above give you advice on multiple scenarios for how partners are given access to customer environments and how you can configure Partner Admin Link to get the right recognition.
- Need to quickly see how to configure Partner Admin Link as a user with PowerShell commands? Jump to the user page and select the PowerShell tab.
- Need to do the same for a service principal? There is a service principal page for that too.
- What if it is a service principal with no client secret, used in a pipeline? We have example GitHub workflows for that on the CI/CD page, and plan to extend that for Azure DevOps and GitLab.
- Need to understand how to approach it if you are using Azure Lighthouse? That is here too, plus we have a separate area dedicated to covering example service offer definitions that will help you configure Partner Admin Link at scale.
You may also have questions on how it works as a mechanism. The Understanding PAL page should give you that grounding on how it all hangs together, and we will treat the Frequently Asked Questions as a live document based on any questions we get asked and that you post on our discussions page.