Running Powershell Scripts Across Tenants using Az Automation and System-Assigned Managed Identity

Question

Running Powershell Scripts Across Tenants using Az Automation and System-Assigned Managed Identity

ash7f 20

I have some Exchange Online PS scripts that I'm running in my own tenant using system-assigned managed identity to avoid interactive and certificate based sign in. Is it possible to run those scripts in another tenant? Say, for example, a customer wants me to run scripts to generate reports for some mail related info in their own tenant. Is there a way that I can run those scripts without having to sign in to the customer's tenant? Maybe if they provide me with their managed identity and possibly other permissions?

I've been doing loads of research but I have a very vague idea and not sure if this is an achievable approach or if there's another option.

Navya 19,795 Reputation points Microsoft External Staff Moderator

2024-10-19T06:13:05.96+00:00

Hi @ash7f

Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Accepted answer

0 additional answers

Your answer

Navya 19,795 Reputation points Microsoft External Staff Moderator

2024-10-19T06:13:05.96+00:00

Hi @ash7f

Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Vasil Michev 119.5K MVP Volunteer Moderator

No, unless you have access to their Azure environment. You can use a generic multi-tenant service principal instead, but they do need to consent to the required permissions (Exchange.ManageAsApp), and you will need to provide client secret or certificate to authenticate.

Anonymous

2024-10-16T02:11:21.2166667+00:00

Hi, @ash7f

Yes, that's right, as Vasul Michev said. Your customers can create an Azure AD application in their tenant and grant the application the necessary API permissions for Exchange Online. Admins in the customer tenant are required to provide admin consent for the requested permissions. You also need to set up a client secret or certificate for application registration.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Share via

Running Powershell Scripts Across Tenants using Az Automation and System-Assigned Managed Identity

0 additional answers

Your answer