Azure AD：如何为其他租户的用户分配应用角色

Question

Let's imagine that I've created Application in Tenant1 and it has "Accounts in any organizational director".

I need to declare in this app 3 roles: SuperAdmin, Admin, Reader.

It's clear how assign roles for users who belong to Tenant1 , but is there any way to assign SuperAdmin role of Tenant1 app to user who belongs to Tenant2 ? Or how should it happen? I need to invite users in Tenant1 from Tenant2?

Answer 1

Basically you will only be able to assign app roles to a user in the tenant where the application is used.

The answer would depend on in which Azure AD (Tenant 1 only or both Tenant 1 and Tenant 2) the application will be used. Or in other words, where the Service Principal for this application will be created - Tenant 1 only or both Tenant 1 and Tenant 2.

If the application is only used in Tenant 1, then you would have to invite the user from Tenant 2 into Tenant 1 and only then you will be able to assign app roles to that user.

However if the application is used in Tenant 2 as well, then you don't have to do anything special. Tenant 2 admins would be able to assign the desired app role to the users in their tenant.