0

My goal here is to be able to use the service principal of an Enterprise Application in source tenant to authenticate towards/connect to destination tenants as Global Administrator.

In source tenant I have added an Enterprise Application. I am able to successfully connect to this tenant with this EA service principal using Connect-AzAccount (providing secret in Credential parameter).

Connect-AzAccount -ServicePrincipal -Credential $srcCredentials -Tenant $srcTenantId -Scope Process -ErrorAction Stop

On destination tenant I use a Global Administrator user to invite the service principal from source tenant (MsGrap) using New-MgInvitation.

New-MgInvitation -InvitedUserType Member -Status Completed -InvitedUserDisplayName "Auto" -InvitedUserEmailAddress "$srcPrincipalObjectId@$srcTenantId" -InviteRedirectUrl "https://myapps.microsoft.com" -SendInvitationMessage:$false -ErrorAction Stop

I then add role of "Global Administrator" to it. When I perform Connect-AzAccount on destination tenant using credentials for Enterprise Application in source tenant, I get error:

Connect-AzAccount -ServicePrincipal -Credential $srcCredentials -Tenant $dstTenantId -Scope Process -ErrorAction Stop

WARNING: The received access token is not valid: at least one of the claims 'puid' or 'altsecid' or 'oid' should be present. If you are accessing as application please make sure service principal is properly created in the tenant.

What am I missing?

Tedd Hansen
  • 674
  • 5
  • 8
  • 17
  • Out of curiosity, do these tenants fall under the same corporate/legal umbrella or are they completely distinct and separate tenants from a corporate/legal perspective? – joeqwerty May 12 '23 at 20:04
  • For testing I have just created multiple tenants, but in production they will be completely separate companies. (It also won't be Global Administrator rights, that is just for PoC.) – Tedd Hansen May 12 '23 at 20:09
  • Hmmm... I'd be very concerned about connecting from one tenant to another tenant unless they were related to each other legally. If I were a customer and I discovered that someone did this I'd promptly fire, then sue them. Just my two cents. As an exercise in "can this be done" it might have value, but I'd never consider doing this for real. – joeqwerty May 12 '23 at 20:14
  • We are located within EU/EFTA, legal and security is always number one concern. :) – Tedd Hansen May 12 '23 at 20:38

0 Answers0