Quick reference page

Once you have authenticated then how do you create a Partner Admin Link? This quick reference page includes a selection of methods and their CLI equivalents. The following pages after this one then run through a few scenarios.

Introduction

Process:

Authenticate as a user, guest, service principal or managed identity in the customer’s tenant.
Link your security principal to the Partner ID using the REST API, CLI, or PowerShell cmdlet.

Reminders:

Each security principal can only be connected to one Partner ID in each tenant.
You cannot create a PAL for another security principal.
Authenticate as that security principal, check the context and create the PAL.
ACR telemetry attribution for that security principal is based on its RBAC role assignments.

Security principal is the collective name for users, guests, service principals and managed identities on the Entra ID platform.

The partner ID used throughout these examples will be 314159. This is not a valid Partner ID and will error. Use your own Partner ID.

Note that the Microsoft.ManagementPartner REST API does not have the first-class REST documentation found for most Azure resource provider.

The API has separate Create and Update methods. There is no combined and idempotent Create or Update method as we commonly see for more recent REST APIs. Therefore the safest method in automation is to get and then create or update as applicable.

REST API Operations

Create

REST API

Create a Partner Admin Link.

PUT https://management.azure.com/providers/Microsoft.ManagementPartner/partners/{partnerId}?api-version=2018-02-01

Example with body

PUT https://management.azure.com/providers/Microsoft.ManagementPartner/partners/314159?api-version=2018-02-01

{
  "partnerId": "314159"
}

CLI commands

az rest --method put \
  --url "https://management.azure.com/providers/microsoft.managementpartner/partners/${partnerId}?api-version=2018-02-01" \
  --body "{\"partnerId\": \"${partnerId}\"}"

Example output:

{
  "etag": 1,
  "id": "/providers/microsoft.managementpartner/partners/314159",
  "name": "314159",
  "properties": {
    "createdTime": "2026-09-15T14:25:52.6156742Z",
    "objectId": "142d2492-a132-4acb-a9bd-78b709298fd2",
    "partnerId": "314159",
    "partnerName": "Azure Citadel",
    "state": "Active",
    "tenantId": "05a64f04-2b2a-4d47-9b12-9b448065bb06",
    "updatedTime": "2026-09-15T14:25:52.6156742Z",
    "version": 1
  },
  "type": "Microsoft.ManagementPartner/partners"
}

az managementpartner create --partner-id "${partnerId}"

Example output:

{
  "createdTime": "2026-09-15T14:25:52.6156742Z",
  "etag": 1,
  "id": "/providers/microsoft.managementpartner/partners/314159",
  "name": "314159",
  "objectId": "142d2492-a132-4acb-a9bd-78b709298fd2",
  "partnerId": "314159",
  "partnerName": "Azure Citadel",
  "state": "Active",
  "tenantId": "05a64f04-2b2a-4d47-9b12-9b448065bb06",
  "type": "Microsoft.ManagementPartner/partners",
  "updatedTime": "2026-09-15T14:58:32.7777762Z",
  "version": 1
}

New-AzManagementPartner -PartnerId $partnerId

Example output:


PartnerId   : 314159
PartnerName : Azure Citadel
TenantId    : 05a64f04-2b2a-4d47-9b12-9b448065bb06
ObjectId    : 142d2492-a132-4acb-a9bd-78b709298fd2
State       : Active

Create will fail if the user or service principal is already linked.

Get

REST API

Get with no Partner ID specified.

GET https://management.azure.com/providers/Microsoft.ManagementPartner/partners?api-version=2018-02-01

Returns the same JSON object as PUT if set. Errors if there is no Partner Admin Link.

Get for a specific partner ID.

GET https://management.azure.com/providers/Microsoft.ManagementPartner/partners/{partnerId}?api-version=2018-02-01

Returns the JSON object if PAL exists and is set to the partner ID. Errors if a) there is no Partner Admin Link or b) a PAL exists but is set to another partner’s Partner ID.

CLI commands

az rest --method get \
  --url "https://management.azure.com/providers/microsoft.managementpartner/partners/${partnerId}?api-version=2018-02-01"

The /${partnerId} section of the URI can be removed for the first variant.

az managementpartner show --partner-id "${partnerId}"

Remove the --partner-id switch for the first variant.

Get-AzManagementPartner -PartnerId $partnerId

Remove the --PartnerId switch for the first variant.

Update

REST API

PATCH https://management.azure.com/providers/Microsoft.ManagementPartner/partners/{partnerId}?api-version=2018-02-01

Example with body

PATCH https://management.azure.com/providers/Microsoft.ManagementPartner/partners/314159?api-version=2018-02-01

{
  "partnerId": "314159"
}

CLI commands

az rest --method patch \
  --url "https://management.azure.com/providers/microsoft.managementpartner/partners/${partnerId}?api-version=2018-02-01" \
  --body "{\"partnerId\": \"${partnerId}\"}"

az managementpartner update --partner-id "${partnerId}"

Update-AzManagementPartner -PartnerId $partnerId

Update will fail if the user or service principal is not already linked.

Delete

REST API

DELETE https://management.azure.com/providers/Microsoft.ManagementPartner/partners/{partnerId}?api-version=2018-02-01

CLI commands

az rest --method delete \
  --url "https://management.azure.com/providers/microsoft.managementpartner/partners/${partnerId}?api-version=2018-02-01"

az managementpartner delete --partner-id "${partnerId}"

Remove-AzManagementPartner -PartnerId $partnerId

Additional install notes

Azure CLI

The Azure CLI’s managementpartner commands require the extension to be installed.

Install the Azure CLI’s managementpartner extension.
```
az extension add --name "managementpartner"
```

PowerShell

Install the Az.ManagementPartner PowerShell module for the cmdlets shown above.

Set the PSGallery installation policy to trusted.

Set-PSRepository -Name PSGallery -InstallationPolicy Trusted

Install the Az.ManagementPartner module.

Install-Module -Name Az.ManagementPartner -Repository PSGallery -Force

We’ll focus on standard user and guest IDs, including using the Portal once you have logged in as a user and switched to the customer’s directory. This is all covered in the next page.

After that we will move through a set of scenarios for service principals and managed identities.

Quick reference page

Table of Contents

Introduction

REST API Operations

Create

REST API

CLI commands

Get

REST API

CLI commands

Update

REST API

CLI commands

Delete

REST API

CLI commands

Additional install notes

Azure CLI

PowerShell

Next