Access multple tenants as Global Administrator with principal from single tenant (PowerShell 7)

Tedd Hansen

5/12/24, 7:58 PM

My goal here is to be able to use the service principal of an Enterprise Application in source tenant to authenticate towards/connect to destination tenants as Global Administrator.

In source tenant I have added an Enterprise Application. I am able to successfully connect to this tenant with this EA service principal using Connect-AzAccount (providing secret in Credential parameter).

Connect-AzAccount -ServicePrincipal -Credential $srcCredentials -Tenant $srcTenantId -Scope Process -ErrorAction Stop

On destination tenant I use a Global Administrator user to invite the service principal from source tenant (MsGrap) using New-MgInvitation.

New-MgInvitation -InvitedUserType Member -Status Completed -InvitedUserDisplayName "Auto" -InvitedUserEmailAddress "$srcPrincipalObjectId@$srcTenantId" -InviteRedirectUrl "https://myapps.microsoft.com" -SendInvitationMessage:$false -ErrorAction Stop

I then add role of "Global Administrator" to it. When I perform Connect-AzAccount on destination tenant using credentials for Enterprise Application in source tenant, I get error:

Connect-AzAccount -ServicePrincipal -Credential $srcCredentials -Tenant $dstTenantId -Scope Process -ErrorAction Stop

WARNING: The received access token is not valid: at least one of the claims 'puid' or 'altsecid' or 'oid' should be present. If you are accessing as application please make sure service principal is properly created in the tenant.

What am I missing?

0 + 4

azure-active-directory

azure-powershell

powershell-v7

joeqwerty

5/12/24, 8:04 PM

Out of curiosity, do these tenants fall under the same corporate/legal umbrella or are they completely distinct and separate tenants from a corporate/legal perspective?

Tedd Hansen

5/12/24, 8:09 PM

For testing I have just created multiple tenants, but in production they will be completely separate companies. (It also won't be Global Administrator rights, that is just for PoC.)

joeqwerty

5/12/24, 8:14 PM

Hmmm... I'd be very concerned about connecting from one tenant to another tenant unless they were related to each other legally. If I were a customer and I discovered that someone did this I'd promptly fire, then sue them. Just my two cents. As an exercise in "can this be done" it might have value, but I'd never consider doing this for real.

Tedd Hansen

5/12/24, 8:38 PM

We are located within EU/EFTA, legal and security is always number one concern. :)

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Access multple tenants as Global Administrator with principal from single tenant (PowerShell 7)

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.