Connect your Microsoft CSP tenant to the Platform using the Partner Consent Wizard

Appxite Updated by Appxite

This article guides Microsoft Cloud Solution Provider (CSP) partners through connecting their Microsoft partner tenant to the Platform. The Partner Consent Wizard verifies the signing administrator, helps the partner select the required the Platform capabilities, creates or validates the integration application, and presents each Microsoft consent step individually.

The recommended process creates a dedicated, partner-owned integration application in the partner tenant. This separates the partner's workload from the previously shared the Platform consent registration, strengthens application ownership and credential isolation, and removes the shared API threshold limitation that can affect integrations using one common application registration.

NOTE! Complete the prerequisites in this article before starting. The same account must remain signed in throughout the wizard and all Microsoft consent screens. 

Use a dedicated partner service account wherever possible. Before opening the wizard, confirm that the account and tenant meet all of the following requirements.

  • The account belongs to the Microsoft CSP partner tenant that will be connected to the Platform.
  • The account has an active Global Administrator role. A currently activated Microsoft Entra Privileged Identity Management (PIM) assignment is accepted.
  • The account is a direct member of the tenant's AdminAgents security group.
  • The AdminAgents membership is permanent. Nested group membership, dynamic membership, or membership inherited through another group is not accepted.
  • The service account will retain its direct, permanent AdminAgents membership after setup so the Platform CSP channel operations continue to work.
  • Multi-factor authentication (MFA) is configured and available for the account. Microsoft Partner Center performs the final authoritative MFA check.
  • The administrator can approve organization-wide delegated permissions in Microsoft Entra ID.
  • Browser cookies are enabled and Microsoft sign-in or consent pages are not blocked.
IMPORTANT! Activate the Global Administrator role before signing in to the wizard. If PIM is activated after sign-in, sign out of the wizard and start a new session so Microsoft and the Platform can evaluate the current role assignment. 

Use the consent link provided by your the Platform representative. the Platform currently operates separate consent portals for the relevant platform environments:

Open only the environment specified for your Platform connection. Confirm that the browser address ends in appxite.net before selecting Sign in with Microsoft.

  1. Select Sign in with Microsoft.
  2. Sign in with the partner service account described in the prerequisites.
  3. Complete MFA when Microsoft requests it.
  4. Confirm that the wizard displays the expected organization name, primary domain, tenant ID, and signed-in administrator.
  5. Review the Administrator eligibility result. The wizard must verify:
    • an active Global Administrator assignment;
    • direct AdminAgents membership; and
    • permanent AdminAgents access.
NOTE! You may see a message stating that MFA evidence was not included in the sign-in token. This does not mean MFA was skipped. Microsoft Entra tokens do not always include authentication-method details. Partner Center performs the authoritative MFA validation before the connection is saved. 

Before offering application setup, the wizard checks whether the tenant already has an Platform connection. This prevents accidental duplicate application registrations.

  • New partner: Continue to application ownership and capability selection.
  • Returning partner: Review the current application, connection status, enabled resources, and latest consent information.
  • Incomplete previous attempt: Resume or retry the existing flow instead of starting another application registration.

Returning partners can renew consent, add capabilities, repair supported registration settings, or explicitly replace the connection. Do not replace an active connection unless the Platform has confirmed that replacement is required.

The wizard provides three application ownership options. The recommended option is selected by default.

Select Create in my tenant to provision a dedicated, single-tenant partner-owned integration application. This is also referred to as the Partner Native App setup.

The wizard will:

  • create the application and its service principal in the authenticated partner tenant;
  • add the signed-in administrator as an application owner;
  • add only the permissions selected in the wizard;
  • disable implicit access-token and ID-token issuance;
  • add the approved the Platform callback URLs displayed on the review page;
  • create a client secret with a validity of exactly ten calendar years; and
  • transfer the credential directly to secure storage without displaying it.

You can edit the proposed application display name before continuing. The default name is the Platform CSP Integration.

Select Use the Platform application only when instructed by AppXite. The wizard requests consent for the selected capabilities through the AppXite-owned integration registration. No application is created in the partner tenant, although Microsoft creates the required enterprise application/service principal when consent is granted.

Select Bring my own application if your organization already owns an appropriate confidential web application in the authenticated tenant.

  1. Enter the application's client ID and current client secret.
  2. Review the exact additive configuration changes proposed by the wizard.
  3. Confirm the repair only when the displayed application is the intended registration.

The wizard does not remove unrelated configuration and does not rotate the supplied secret. If the secret cannot be validated after consent, the active Platform connection is not changed.

IMPORTANT! Client secrets are accepted only after Microsoft has authenticated the acting tenant. The wizard never displays the value again. Never send a client secret to AppXite by email, ticket comment, chat, or screenshot. 

The wizard groups Microsoft permissions by business function so the Global Administrator can understand why each set is requested. Required capabilities are selected and locked.

Capability Microsoft permission Why AppXite requires it
Core CSP connection Microsoft Graph User.Read Associates the sign-in and resulting connection with the correct service account and tenant.
Core CSP connection Microsoft Partner user_impersonation Retrieves partner prices and market-specific commercial information. This endpoint is mandatory.
Core CSP connection Microsoft Partner Center user_impersonation Supports the customer, subscription, order, and CSP channel operations required by the  Platform. This endpoint is mandatory.
Graph partner billing Microsoft Graph PartnerBilling.Read.All Reads partner billing data used by the Platform billing workflows. It is included in every new setup.

This connection forms the foundation of the integration. It's always active, applies to every tenant, and doesn't require any additional configuration beyond initial consent.

Mandatory: Graph partner billing

Graph partner billing is a mandatory capability and is included automatically in every new setup; it cannot be deselected.

Microsoft has moved partner invoice retrieval to Microsoft Graph, so the Platform now uses the Microsoft Graph PartnerBilling.Read.All scope to read partner billing data instead of the legacy invoice-download process.

This scope supports the Platform's billing workflows, including invoice downloads, and its exact permission is shown on this step before consent is granted.

Select GDAP management when the Platform will inspect or manage delegated administration relationships, access assignments, and the partner security groups that support those assignments. The following permissions are granted as one supported bundle:

  • Application.ReadWrite.All
  • DelegatedAdminRelationship.Read.All
  • DelegatedAdminRelationship.ReadWrite.All
  • DelegatedPermissionGrant.ReadWrite.All
  • Directory.Read.All
  • Group.Read.All
  • Group.ReadWrite.All
  • GroupMember.ReadWrite.All

These permissions are required together for supported GDAP relationship and group-management functionality. Do not attempt to remove individual permissions from this bundle.

Directory.ReadWrite.All is a separate, conditional option. Select it only when a GDAP relationship toward customers grants Global Administrator and the intended Platform workflow must modify directory objects. Standard GDAP management does not require this broader directory-write permission.

Azure Service Management user_impersonation allows the Platform to obtain an access token whose audience is https://management.azure.com. This permission does not grant access to Azure subscriptions by itself; effective operations still depend on the service account's Azure role-based access control (RBAC) assignments.

Select Microsoft 365 Lighthouse to enable the complete supported read-only reporting module. The following scopes are included together:

Microsoft Graph scope Information used by the Platform
ManagedTenants.Read.All Tenants, tenant groups and search, usage, audit events, templates, actions, roles, and tags.
CloudPC.Read.All Cloud PC connections, devices, and overview data.
DeviceManagementConfiguration.Read.All Aggregated configuration and policy-compliance coverage.
DeviceManagementManagedDevices.Read.All Device compliance, malware, and Windows protection data.
Policy.Read.All Conditional Access policy coverage.
Reports.Read.All Credential-registration summaries used in Lighthouse reporting.

Effective Lighthouse data access also depends on the tenant's Microsoft licensing, Lighthouse relationships, and Microsoft service authorization.

Review the requested changes

Select Preview changes and read the complete change summary before approving anything. The review page identifies:

  • the authenticated partner tenant and acting administrator;
  • the application ownership option and application display name;
  • every Microsoft API resource and delegated scope;
  • the callback URLs that will be added;
  • whether an application, service principal, owner, or credential will be created;
  • the ten-year credential lifetime for a partner-created application; and
  • the Microsoft Partner Center MFA requirement.

If the tenant, application, or permission set is not correct, return to the configuration page. Do not continue and attempt to correct the connection afterward.

  1. Select the confirmation button on the review page.
  2. If Create in my tenant was selected, the wizard creates the application, enterprise application/service principal, permissions, ownership, callbacks, and credential.
  3. Wait for the mandatory 15-second Microsoft Entra propagation period. The countdown gives Microsoft time to make the new registration available to its consent services.
  4. When the countdown finishes, continue to the first Microsoft consent request.
IMPORTANT! Do not refresh the page, open the same flow in another tab, or attempt to bypass the propagation countdown. Starting consent too quickly can cause Microsoft to report that the newly created application or service principal is unavailable. 

Microsoft requires consent for each selected API resource. The Platform wizard displays a progress page between Microsoft screens so you always know what has been approved and what comes next.

  1. On the AppXite progress page, review the current Microsoft resource and its exact delegated scopes.
  2. Select Continue to Microsoft.
  3. Confirm that Microsoft shows the expected application, organization, and permissions.
  4. Select Accept to grant organization-wide consent.
  5. After Microsoft returns to the Platform, review the updated progress page. Completed resources are marked as approved and the next resource is displayed.
  6. Repeat the process until all selected resources are complete.

Microsoft Partner Center is processed first. Microsoft performs the authoritative MFA compliance check during this part of the flow. Depending on the selected capabilities, additional consent screens can include Microsoft Graph, Microsoft Partner, and Azure Service Management.

NOTE! The wizard adds protocol scopes such as openid, profile, and offline_access when Microsoft requires them. These support secure sign-in and long-running delegated access; they are not presented as separate AppXite business capabilities. 

After all consent requests are approved, the wizard completes a secure authorization step, validates the resulting Microsoft tokens, and saves the active connection. No secret, access token, refresh token, or authorization code is shown on the completion page.

Verify that the completion page shows:

  • Partner consent completed;
  • the expected tenant ID;
  • the expected application name and client ID;
  • the selected application source; and
  • the expected active Microsoft resource groups.

Select Return to overview to view the connected tenant. The service account's direct AdminAgents membership must remain in place for ongoing CSP channel functionality.

SUCCESS! When the completion page is displayed, the application, permissions, and credentials have been validated before the connection becomes active. 

The Microsoft Partner Center service principal is unavailable in this tenant

The sandbox CSP tenant is unable to sign the consents This issue stems from an incomplete CSP setup at the tenant level; the prerequisite CSP Program owned applications required for the consent process have not been provisioned by Microsoft.

This is a rare edge case, and tenant admin intervention is needed to ensure that these Microsoft owned applications are enabled.

Resolution: The necessary applications can only be enabled via the Azure CLI. The tenant admin should run the following command to provision the required applications:

$tenantId = "<CSP tenant Id>"

az login --tenant $tenantId --allow-no-subscriptions --output none
if ($LASTEXITCODE -ne 0) { throw "Login failed." }

$activeTenant = az account show --query tenantId --output tsv
if ($LASTEXITCODE -ne 0 -or $activeTenant -ne $tenantId) {
    throw "Wrong tenant selected."
}

$appIds = @(
    "4990cffe-04e8-4e8b-808a-1175604b879f" # MSPC
    "fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd" # PARTNER
)

foreach ($appId in $appIds) {
    $objectId = az ad sp list --filter "appId eq '$appId'" --query "[0].id" --output tsv --only-show-errors
    if ($LASTEXITCODE -ne 0) { throw "Lookup failed for $appId." }

    if ([string]::IsNullOrWhiteSpace($objectId)) {
        Write-Host "Creating: $appId"
        az ad sp create --id $appId --output none --only-show-errors
        if ($LASTEXITCODE -ne 0) { throw "Creation failed for $appId." }
    } else {
        Write-Host "Already present: $appId"
    }

    az ad sp show --id $appId --query "{Name:displayName,AppId:appId,ObjectId:id,Enabled:accountEnabled}" --output table
    if ($LASTEXITCODE -ne 0) { throw "Verification failed for $appId." }
}

 

  • Confirm that the role is active in the same tenant displayed by the wizard.
  • If the role uses PIM, activate it before signing in.
  • Sign out of the wizard and start a new session after activation.
  • Do not continue with a different tenant or guest account.
  • Confirm that the group is the tenant's assigned-membership security group named AdminAgents.
  • Add the acting service account directly to the group.
  • Nested or dynamic group membership is not accepted.
  • Ensure the membership is permanent, then start a new wizard session if the assignment was just changed.

This is informational unless Microsoft later rejects the Partner Center step. Continue through Partner Center and complete MFA when requested. Microsoft makes the final MFA compliance decision.

Return to the safe sign-in recovery page and choose Sign in with MFA instead. Complete another authentication method permitted by your organization's Conditional Access policy. The Platform cannot bypass or weaken a Microsoft authentication policy.

Microsoft Entra propagation can occasionally take longer than expected. Return to the tenant overview and resume or retry the existing flow. Do not create a duplicate application.

The connection is not activated with a partial permission set. Return to the overview and resume or retry the flow with the same eligible administrator. If your organization cannot approve a requested scope, contact the Platform Support before changing the application manually.

Sign out immediately. Start a private browser session and authenticate with an account from the intended CSP partner tenant. Never approve consent when the organization name, primary domain, or tenant ID is unexpected.

  • The initial release supports the Microsoft global/commercial cloud.
  • Application and service-principal propagation is controlled by Microsoft and can occasionally take longer than the built-in delay.
  • The wizard does not delete existing partner-owned applications or revoke existing permissions.
  • Extra configuration in a partner-provided application is preserved; the wizard applies only approved additive repairs.
  • A ten-year secret is mandatory for a newly created partner application. If tenant policy rejects that lifetime, the wizard stops and rolls back the application objects created by that attempt.
  • Permission approval does not override Azure RBAC, GDAP relationship roles, Lighthouse relationships, licensing, or Microsoft Conditional Access.

The Platform Partner Consent Wizard provides a guided and tenant-aware method for establishing Microsoft CSP integration. It verifies Global Administrator and permanent direct AdminAgents access, defaults to a dedicated partner-owned application, explains mandatory and optional permissions, waits for Microsoft Entra propagation, and separates every Microsoft resource consent with a clear progress page. The connection becomes active only after all selected permissions and Microsoft tokens have been validated.

Was this article helpful?

0 out of 0 found this helpful

Articles in this section

Add comment

Please sign in to leave a comment.