how to let automation account get information in another tenant

Question

we registered an application A in tenant A

and we have an automation account in tenant B

now, we would like to use this automation account to create a cron job to monitor the application A client’s secret expiration,

so we would like to know how we can grant permission to the automation account to get application A client’s secret expiration because they are in different tenants.

Answer 1

Here is one way to accomplish this:

1. Configure the app in tenant A

• Grant the app the necessary Microsoft Graph API permissions (e.g., Application.Read.All or Application.ReadWrite.All) for accessing application secrets. Ensure this is an Application permission.
• Grant admin consent for these permissions in Tenant A.

2. Create a client secret for the app

• Generate a client secret for the app and securely store the secret (e.g., in an Azure Key Vault in the subscription associated with tenant B).

3. Assign the app registration to monitor application secrets

• Use Microsoft Graph to list the secrets for application in tenant A.
  • Example: Use the endpoint GET https://graph.microsoft.com/v1.0/applications/{application-id}.
  • This will return the passwordCredentials property, which includes expiration details.

4. Create a service principal for tenant A in tenant B

• In tenant B, create a service principal (SP) for the app registration in tenant A:

5. Configure the Azure Automation account in the subscription associated with tenant B

• Import the necessary modules
  • AzureAD (if using Azure AD cmdlets).
  • Az.Accounts (if authenticating via service principal).
  • Microsoft.Graph SDK (for Graph API calls).

6. Grant permissions across tenants

• In tenant A, create a custom role or use built-in roles (like Reader or App Administrator) and assign it to the service principal for Tenant B.

7. Create an Automation runbook

• Use the runbook to:
  • Authenticate as the service principal in tenant A.
  • Query Microsoft Graph API for application secrets.
  • Parse and log expiration dates, or send alerts if expiration is near.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin