Cross tenant access to resources as a SaaS provider

Question

Hi,

I have a use case where we (SaaS provider) would like to send outbound messages to our customer's service bus queue. Our customers would like to give our user/identity permissions to send messages to their bus. (similar to other cloud platforms where our customers can give permissions to an IAM user).

I am not able to find a good programmatic way in Azure without inviting users and verifying manually via email.

Would be good to know a recommended way to give access to resources across tenants.

Answer 1

Hello @sahil.anand - Thanks for reaching out, and engaging the MS Q&A community.I believe that your question isn't really specific to Service Bus, rather, it seems a general Microsoft Entra ID-specific question concerning how to programmatically grant cross-tenant access.

Here's the official doc: Overview of Microsoft Entra External ID

As you've already discovered, B2B collaboration supports invite-based user sign-up/registration. However, if the programmatic way is a must in your scenario, the doc states the following on the matter:

Use Microsoft Entra entitlement management, an identity governance feature that lets you manage identity and access for external users at scale by automating access request workflows, access assignments, reviews, and expiration.

I recommend exploring the above first. If it seems like overkill, Azure Service Bus supports SAS token-based access as well: Service Bus access control with Shared Access Signatures