User IDs & PAL
If you are have a user ID in a customer tenant to provide a managed service on their Azure services then follow this page to configure Partner Admin Link.
In brief
-
Authenticate in the customer context:
- sign on as the user the customer created for you in their tenant, or
- if invited as a guest into their tenant then a) sign on and b} switch directory to the customer tenant
-
Link your ID to the PartnerID using the CLI, PowerShell or the Azure Portal screen.
The information here is lifted straight from the main documentation which is found at https://aka.ms/partneradminlink.
Creating the Partner Admin Link
When you have access to the customer’s resources, use the Azure portal, PowerShell, or the Azure CLI to link your Partner ID to your user ID. Link the Partner ID in each customer tenant.
First, ensure you have authenticated as the correct user and you are in the correct customer directory.
-
Open the Azure Portal.
-
Click on the Settings icon at the top.
-
Select the Microsoft partner network link in Useful Links at the bottom left.
-
Enter your Partner ID.
-
Click on the Link a partner ID button to save.
Use PowerShell to create the link
-
Install the Az.ManagementPartner PowerShell module.
Install-Module -Name Az.ManagementPartner -Repository PSGallery -Force -
Sign in to the customer’s tenant.
Connect-AzAccount -TenantId <tenantId> -
Create the Partner Admin Link.
New-AzManagementPartner -PartnerId <partnerId> -
Additional commands
Display the partner ID.
Get-AzManagementPartnerUpdate the partner ID.
Update-AzManagementPartner -PartnerId <partnerId>Delete the Partner Admin Link.
Remove-AzManagementPartner -PartnerId <partnerId>
Use the Azure CLI to create the link
-
Install the Azure CLI’s managementpartner extension.
az extension add --name "managementpartner" -
Sign in to the customer’s tenant.
az login --tenant "<tenantId>" -
Create the Partner Admin Link.
az managementpartner create --partner-id "<partnerId>" -
Additional commands
Display the partner ID.
az managementpartner showUpdate the partner ID.
az managementpartner update --partner-id "<partnerId>"Delete the Partner Admin Link.
az managementpartner delete --partner-id "<partnerId>"
Why do you have to switch into each customer tenant?
Your user ID in your home tenant may have been invited as a guest to multiple customer environments. You are signing in with the same MFA each time, so why do you need to switch into each customer tenant and recreate the Partner Admin Link in each one?
When you accept an invitation, Entra creates a new objectId in the customer’s tenant. (The User Principal Name for a guest ID includes #EXT#, e.g. first.last_partner.com#EXT#@customer.com.)
The Partner Admin Link is between the tenantId.objectId and the partnerId as you can see in the JSON output above for the Azure CLI commands.