Share via

Cross-tenant connection between Azure Data Factory and Blob Storage

Luigia Costabile 65 Reputation points
2025-09-13T10:48:07.9166667+00:00

The scenario is as follows: ADF belongs to tenant A and Blob Storage to tenant B.

Is the use of a multi-tenant service principal supported by the ADF connector to Blob Storage?

The use of a multi-tenant service principal is preferred because in this way the secret is not communicated to tenant B and is managed exclusively by tenant A.

Has anyone used this approach?

Azure Data Factory
Azure Data Factory
An Azure service for ingesting, preparing, and transforming data at scale.

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Nandan Hegde 36,716 Reputation points MVP Volunteer Moderator
    2025-09-13T11:08:03.28+00:00

    As long as the ADF and blob are in seperate tenants,you can use service principal authentication as best form of authentication. And the service principal need not be multiple tenant,it must be of the tenant in which the blob is present

    0 comments
  2. Swapnesh Panchal 1,380 Reputation points Microsoft External Staff Moderator
    2025-09-15T11:38:48.9966667+00:00

    Hi Luigia Costabile ,

    Welcome to the Microsoft Q&A Platform.
    As mentioned by Nandan Hegde cross-tenant access is supported using a service principal.
    and approach is:

    1. App registration in Tenant A Create an app registration in Tenant A. If you want credentials managed only in Tenant A, configure it as a multi-tenant app.
    2. Create a service principal in Tenant B In Tenant B (where the Blob Storage lives), create a service principal (enterprise application) for that app.
    3. Assign RBAC roles in Tenant B Grant the service principal in Tenant B the required roles on the storage account or container (e.g., Storage Blob Data Contributor).
    4. Configure ADF Linked Service in Tenant A In ADF, configure the Linked Service to authenticate using the app registration’s client ID and secret, and specify Tenant B as the authority/tenant ID.
    5. Validate networking Ensure firewalls, private endpoints, and container ACLs are configured so that ADF in Tenant A can reach Blob Storage in Tenant B.
      Note: Managed identities from Tenant A cannot directly be used across tenants. Cross-tenant access requires a service principal/enterprise application mapping as described above.
    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.