第三方的Azure Management API访问权限

Question

I am developing an application that integrates with other business' Azure accounts. My application needs read access to the Azure Monitor service in our customers' Azure accounts. What is the best way to authenticate?

After reading, here's the current solution I came up with:

Have a customer create an App registration in their account. After creating the app registration, they assign the Monitoring Reader role to the application they created. The customer then will navigate back to the App registration and create a Client Secret. The customer then provides my service the client ID, tenant ID, and a Client Secret. My service will use those to authenticate with Azure and call Azure Monitor.

Is this the recommended way to authenticate with Azure as a 3rd party?

Answer 1

I am not sure if it the best way, but indeed it is a feasible way. This way named client credentials flow , you need to use this way to request the access token, then use the token to call azure rest api, eg Alert Rules - Get .

When you request the token, you need to specify the resource with https://management.azure.com/ , also, you should note v1.0 endpoint is different with v2.0 , v2.0 uses scope not resource , for difference details see this link . So you should choose the correct one depends on which version app your customer created.

Besides, correct some of your understanding of azure ad tenant and azure subscription. They are not called Azure account, the Azure monitor is a service in the subscription, the subscription locates in the tenant. The AD app(app registration) also locates in the tenant. You can understand the AD app is higher than the subscription, it is not in the subscription.