13,721 questions
MS Graph Change Notifications for a multi-tenant application
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 42%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERM%3C/text%3E%3C/svg%3E)
Rohit Mani
1
Reputation point Microsoft Employee
Hi,
My team is looking into using MS Graph Change Notifications to get notifications for any changes to a User resource. We will be using the Event Hubs mechanism of getting the notifications delivered.
Since this is a multi-tenant application, will we get change notifications for all tenants delivered to the same event hub assuming we go through the subscription flow for each tenant?
Microsoft Security Microsoft Graph
{count} votes
-
ShaikMaheer-MSFT 38,546 Reputation points Microsoft Employee Moderator2022-08-26T05:55:55.09+00:00 Hi @Rohit Mani , I am checking this with internal team. I will share updates once I here back.
-
ShaikMaheer-MSFT 38,546 Reputation points Microsoft Employee Moderator
2022-09-01T10:23:24.517+00:00 Hi @Rohit Mani ,
I think this is a question for the MS Graph team as it depends on how they configure their streams and/or subscription filters and their routing. i.e. can they configure multiple event hub instances or is there only one event hub reference for the whole tenant. Updated tags accordingly on the question.
-
Pratik Gautam 1 Reputation point Microsoft Employee2022-09-23T15:01:58.013+00:00 Hi @Rohit Mani ,
As per the change notification delivery document, we configure Access Policy on Azure Key Vault for MS Graph change tracking service principal application with GET permissions all within the same Tenant.
Currently, in-case of a multi-tenant scenarios where Key Vault is in Tenant A and the MS Graph change tracking service principal application in Tenant B, it seems this isn't possible as we can't configure the service principal access policy that way on Azure Key Vault. More details here
Thus, we would need Azure Key Vault and the graph change tracking SP in same tenant.
Although, we would appreciate your feedback on this via channels below:
- https://techcommunity.microsoft.com/t5/microsoft-365-developer-platform/idb-p/Microsoft365DeveloperPlatform
- https://aka.ms/graphfeedback
Hope this answers your question?
Sign in to comment
Sign in to answer