Edit

Authorize cross-tenant partner applications for Microsoft Planetary Computer Pro

This article guides IT and cloud administrators through the process of authorizing a third-party partner application to access GeoCatalog resources. By completing these steps, you enable partner organizations—such as geospatial data providers or analytics services—to read from and write data to your Microsoft Planetary Computer Pro GeoCatalogs.

Prerequisites

  • Azure account with an active subscription - create an account for free
  • An existing GeoCatalog resource
  • One of the following Microsoft Entra ID roles:
    • Global Administrator
    • Application Administrator
    • Cloud Application Administrator
  • Owner or User Access Administrator role on the GeoCatalog resource
  • Azure CLI installed and configured - install the Azure CLI
  • Information from your partner:
    • Partner's Application (client) ID
    • Redirect URI configured in the partner's application registration (Optional)

Overview

Authorizing a partner application involves three main steps:

  1. Create a service principal for the partner's application in your tenant
  2. Grant admin consent to the application's permission requests
  3. Assign GeoCatalog roles to the service principal
flowchart LR
    A[Receive partner<br/>app details] --> B[Create service<br/>principal]
    B --> C[Grant admin<br/>consent]
    C --> D[Assign GeoCatalog<br/>Administrator role]
    D --> E[Partner can<br/>access GeoCatalog]

Create a service principal for the partner application

A service principal is the representation of an application in your Microsoft Entra tenant. Creating a service principal for the partner's application ID establishes the identity that you can then grant permissions to.

  1. Sign in to Azure CLI with an account that has Application Administrator permissions:

    az login --tenant <your-tenant-id>

  2. Verify you're signed into the correct tenant:

    az account show --query "{TenantId:tenantId, User:user.name}" -o table

  3. Check if a service principal already exists for the partner application:

    az ad sp list --filter "appId eq '<partner-application-id>'" --query "[0].id" -o tsv

    If this command returns an object ID, the service principal already exists. Skip to the next section.

  4. Create the service principal:

    az ad sp create --id <partner-application-id>

    Example output:

    {
  "accountEnabled": true,
  "appId": "f914857f-af79-4a22-8a37-85e772c01b7f",
  "displayName": "Partner Geospatial App",
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  ...
}

  5. Save the service principal's id value (object ID) for use in subsequent steps:

    # Store the service principal object ID
SP_ID=$(az ad sp list --filter "appId eq '<partner-application-id>'" --query "[0].id" -o tsv)
echo "Service Principal ID: $SP_ID"

Admin consent authorizes the partner application to use the requested permissions. This step is required before the application can authenticate against your tenant. Your partner should provide a link to perform this action as part of the application onboarding process.

Note

You can optionally contruct this URL yourself:

Construct the admin consent URL using your tenant ID and the partner's application ID:

https://login.microsoftonline.com/<your-tenant-id>/adminconsent?client_id=<partner-application-id>&redirect_uri=https://localhost:8080/callback

The redirect URI must match one of the URIs configured in the partner's application registration. Confirm the correct URI with your partner.

  1. Open the URL in a web browser and sign in with a Global Administrator or Application Administrator account.

  2. Review the requested permissions and select Accept to grant consent.

    After consent is granted, you're redirected to the specified redirect URI. You can close this browser window.

  3. Verify that admin consent was granted by checking the service principal's permissions:

    az rest --method GET --url "https://graph.microsoft.com/v1.0/servicePrincipals/$SP_ID/oauth2PermissionGrants"

    Example output when consent has been granted:

    {
  "value": [
    {
      "clientId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "consentType": "AllPrincipals",
      "id": "abc123def456",
      "principalId": null,
      "resourceId": "98765432-abcd-ef12-3456-7890abcdef12",
      "scope": "User.Read"
    }
  ]
}

    If the value array is empty, admin consent hasn't been granted yet.

You can also grant admin consent through the Microsoft Entra admin center:

  1. Sign in to the Microsoft Entra admin center
  2. Navigate to Identity > Applications > Enterprise applications
  3. Select the Application Type filter and set to value "All Applications"
  4. Find the partner application by using the search bar to enter the application name or ID. Select the partner application from the filtered list.
  5. Select Security > Permissions in the left sidebar
  6. Select Grant admin consent for [your tenant]
  7. Review and accept the permissions

Assign the appropriate GeoCatalog role

The service principal for your data or service provider needs the appropriate role in order to interact with your GeoCatalog resources. Assign the GeoCatalog Reader role to applications that only need read access to your GeoCatalog. Assign the GeoCatalog Administrator role to applications that need to create collections, ingest data, and manage items in your GeoCatalog.

Note

The partner application integration feature is currently in preview and doesn't support a specific, limited access role for data or service provider partners. For this reason, it's recommended during the preview period that customers create a GeoCatalog resource dedicated to a specific partner to prevent access to other, organizational private, data.

  1. Get your GeoCatalog resource ID:

    # Set your resource details
SUBSCRIPTION_ID="<your-subscription-id>"
RESOURCE_GROUP="<your-resource-group>"
GEOCATALOG_NAME="<your-geocatalog-name>"

# Construct the resource ID
GEOCATALOG_RESOURCE_ID="/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.Orbital/geoCatalogs/$GEOCATALOG_NAME"

  2. Verify the GeoCatalog resource exists and you have access:

    az resource show --ids $GEOCATALOG_RESOURCE_ID --query "{Name:name, Location:location, Type:type}" -o table

  3. Find the desired role definition:

    az role definition list --name "GeoCatalog Administrator" --query "[0].id" -o tsv

  4. Check if the role assignment already exists:

    az role assignment list --assignee $SP_ID --scope $GEOCATALOG_RESOURCE_ID --query "[?roleDefinitionName=='GeoCatalog Administrator']" -o table

  5. Create the role assignment:

    az role assignment create \
  --assignee $SP_ID \
  --role "GeoCatalog Administrator" \
  --scope $GEOCATALOG_RESOURCE_ID

    Example output:

    {
  "id": "/subscriptions/.../providers/Microsoft.Authorization/roleAssignments/...",
  "principalId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "roleDefinitionName": "GeoCatalog Administrator",
  "scope": "/subscriptions/.../resourceGroups/.../providers/Microsoft.Orbital/geoCatalogs/...",
  ...
}
  • Last updated on