Partner Admin Link
Microsoft-managed partners can configure Partner Admin Link for recognition of their influence in customer accounts.
Overview
Partner Admin Link is an important mechanism for Microsoft to recognise the influence and impact that partners to bring to their customers on Azure.
At one level it is fairly simple. If you have access to a customer environment as part of your managed service delivery then creating a Partner Admin Link associates the usage telemetry - which is always being collected for billing purposes - with the Partner ID. It is based on the RBAC role assignments for that access so that the partner gains recognition for the specific resources. Configuration for a user is quick and simple and doesn’t require any involvement from the customer.
However, there are several scenarios for how partners access customer environments and this set of guidance aims to help you get to those configurations quickly.
- Need to quickly see how to configure Partner Admin Link as a user with PowerShell commands? Jump to the user page and select the PowerShell tab.
- Need to do the same for a service principal? There is a service principal page for that too.
- What if it is a service principal with no client secret, used in a pipeline? We have example GitHub workflows for that on the CI/CD page, and plan to extend that for Azure DevOps and GitLab.
- Need to understand how to approach it if you are using Azure Lighthouse? That is here too, plus we have a separate area dedicated to covering example service offer definitions that will help you configure Partner Admin Link at scale.
You may also have questions on how it works as a mechanism. The Understanding PAL page should give you that grounding on how it all hangs together, and we will treat the Frequently Asked Questions as a live document based on any questions we get asked and that you post on our discussions page.
Understanding PAL
Learn about Partner Admin Link, why it's important, how it works, and your options.
User IDs & PAL
If you are have a user ID in a customer tenant to provide a managed service on their Azure services then follow this page to configure Partner Admin Link.
Service principals & PAL
Here is a short guide to creating Partner Admin Links for existing service principals.
CI/CD pipelines & PAL
Workload identities securely using OpenID Connect are becoming the prevailing standard. As they don't have client secrets then using a dedicated workflow is another approach to create a Partner Admin Link.
Creating a dedicated PAL service principal
In the final service principal scenario, we'll look at creating a service principal purely for recognition purposes.
Azure Lighthouse & PAL
Combining Partner Admin Link with Azure Lighthouse reduces some of the administrative overhead. How does it differ compared to more traditional PAL configurations?
PAL FAQ
The Understanding PAL page helps to answer most of your questions on Partner Admin Link. Here you'll find a link to the main Microsoft FAQ for PAL, plus an option to ask more questions here.