Azure AD在租户/订阅中共享托管服务身份

Question

Azure AD have B2B collaboration for inviting external users.

But what if i wan't to invite an external Azure service that have a MSI.

Is it possible to create an Azure AD group and add a external(another subscription/tenant in Azure) MSI which i can then use to grant access to resources?

Say I wan't to allow a B2B partners Data Factory access to SQL database of ours and I do not wan't to give them a SQL Login.

Answer 1

MSIs are service principals which cannot be invited to other tenants. They are always tenant-specific.

The scenario sounds like you need to give access to something connected to your tenant. I would suggest creating an App registration (Application), adding a key, and giving those credentials to the other service. You can then give the application access to your Azure subscription etc.