Sharepoint permission multi tenant

Question

Hi

I am a global admin in my own tenant.
Right now, I am trying to develop a PowerShell script to get all customer's tenants with its site, subsite and permission. More than 50 tenant.
Also, I want to run this unattended.

I just need some idea how to start on this
Do I need to create service principle on this?
Do I need to create a guest account for each tenant?
Is MS Graph available to get SP permission. I don't think so.
Any module that can help me with this.

Answer 1

Hi @Muhammad Suhail Asrulsani

According to my experience, if you want to perform cross-tenant access, first need to create an application in your original tenant and grant it application permissions to access sites and sub-sites. Then you need to run the admin consent URL( https://login.microsoftonline.com/{customer tenant id}/adminconsent?client_id={client-id} ) in the browser and log in with the administrator of the target tenant and consent. After that, the application will be added to the target tenant as an enterprise application, and the application will also have the application permissions granted by you in the original tenant. Next, you only need to use the unattended client credential flow to obtain the access token and call the api to obtain the sites and subsites of all customer tenants.

But what I have to say is that ​because the tenant id of each tenant is different, you may have to run the admin consent URL more than 50 times in the browser to add your application to each customer tenant.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello @Muhammad Suhail Asrulsani

Yes, it is possible. Windows PowerShell allows Syndication and Cloud Solution Provider (CSP) partners to easily administer and report on customer tenancy settings that are not available in the Microsoft 365 admin center.

Syndication and Cloud Solution Provider (CSP) partners can access the data that makes up customer tenant reports directly via remote Windows PowerShell for Exchange Online PowerShell.

Here is an article that will walk you through the process.

Manage Microsoft 365 tenants with Windows PowerShell for Delegated Access Permissions (DAP) partners
https://learn.microsoft.com/en-us/microsoft-365/enterprise/manage-microsoft-365-tenants-with-windows-powershell-for-delegated-access-permissio?view=o365-worldwide

Retrieve customer tenant reporting data with Windows PowerShell for Delegated Access Permissions (DAP) partners
https://learn.microsoft.com/en-us/microsoft-365/enterprise/retrieve-customer-tenant-reporting-data-with-windows-powershell-for-delegated-ac?view=o365-worldwide

Hope this resolves your Query!!

--If the reply is helpful, please Upvote and Accept it as an answer--