I manage multiple customer tenants through Partner Center and already have the required delegated roles configured. I need to run a PowerShell report against tenants that use Security Defaults rather than Conditional Access; these customers generally have Business Basic or Business Standard licensing.
The script works for one tenant when run interactively. It signs in to Microsoft Graph and Exchange Online, retrieves licensed member users, checks their registered authentication methods, identifies shared mailboxes, and exports the results to a CSV file. The main information I need is which real, licensed mailboxes have Microsoft Authenticator registered, while excluding shared mailboxes.
The difficulty is running the same report across every delegated tenant without manually signing in to each one. Ideally, the script would obtain the tenant list from Partner Center, connect using the existing GDAP relationships or another service-principal-based method, collect the data, and produce either one combined report or a separate file per tenant.
Is there a practical way to loop through all delegated tenants from the partner tenant, or is interactive authentication required for every customer? I am also open to a better approach for retrieving licensed users, excluding shared mailboxes, and checking whether Microsoft Authenticator is registered.
2 Answers
If you are using delegated interactive authentication, you can keep the Graph connection in process scope and reconnect for each tenant. A basic pattern is to loop through your tenant records, call Connect-MgGraph with the appropriate tenant context, run the report, export the results, and then call Disconnect-MgGraph before moving to the next tenant. However, this does not remove the need to authenticate interactively for each tenant. It is mainly useful when you already have credentials or tokens available for every customer. The shared-mailbox lookup may also be possible through Graph, which would avoid maintaining a separate Exchange Online connection.
For unattended execution, look at an Azure Automation runbook or Azure Function using a multitenant app registration or managed identity. The application needs appropriate Microsoft Graph permissions and administrator consent in each customer tenant, with access limited by the relevant GDAP relationships. The job can retrieve the delegated tenant list, iterate over tenant IDs, acquire a token for each tenant, and query users and authentication methods without prompting at every iteration. You could then add the tenant name or ID to each output object and export one consolidated CSV.
Be careful not to assume that a GDAP relationship by itself grants application permissions. The service principal must be present and consented in each customer tenant, and the required Graph permissions must be supported for the authentication-method endpoints you use. Also, querying registered authentication methods tells you that Authenticator is registered; it does not necessarily prove that it is the method currently used for every sign-in.
Understood. Existing delegated administration can help with authorization, but it is not automatically the same as unattended application authentication. You would need to verify whether your GDAP setup and an app registration can be used for the required Graph calls; otherwise, interactive sign-in per tenant may be unavoidable.
That is the part I am trying to clarify. If every customer still has to be authenticated manually, looping the script does not really solve the problem. I was hoping to use the existing partner delegation rather than sign in separately to each tenant.