I manage multiple customer tenants through Partner Center and have the required delegated administration relationships and roles in place. These tenants use Security Defaults rather than Conditional Access, and most have Business Basic or Business Standard licenses. I need to run a PowerShell report against every tenant that identifies enabled, licensed user accounts, excludes shared mailboxes, and shows whether Microsoft Authenticator is registered as an authentication method. The script works for one tenant, but it currently requires interactive Microsoft Graph and Exchange Online sign-ins and saves a separate CSV report locally. I would like to automate the process from my partner tenant by looping through the customer tenant IDs, using the existing delegated relationships where possible, and exporting either one report per tenant or a combined report. Is this possible without manually authenticating to every customer tenant?
2 Answers
You can loop through the tenants and use process-scoped Graph connections, for example connecting with Connect-MgGraph inside the loop and calling Disconnect-MgGraph before moving to the next tenant. However, that still means interactive authentication for each tenant if you are using delegated sign-in. You will need an app-only approach if the goal is unattended execution. Register a multitenant application or use an appropriate automation identity, obtain admin consent and the required Graph permissions in each customer tenant, and then request a token for each tenant ID. Your GDAP relationships and directory roles do not automatically turn an interactive delegated connection into unattended app authentication. Also check that the permissions required for reading authentication methods are actually available through the chosen delegation and application model.
For a scheduled solution, put the script in an Azure Automation runbook or an Azure Function and use a multitenant app registration or managed identity. Store the customer tenant IDs, acquire a Graph token for each tenant, and query the authentication methods for the users in that tenant. The app needs the appropriate application permissions and consent in every customer tenant; GDAP can help scope delegated administration, but it is not by itself a replacement for tenant-level app consent. You can keep the Exchange Online lookup if you need authoritative shared-mailbox detection, although that introduces another authentication and permission model. If you only need regular licensed mailboxes, consider whether Exchange data can be queried through a suitable app-only Exchange connection and filter on RecipientTypeDetails before joining the results to the Graph MFA data. Exporting objects to CSV is simpler and more reliable than opening Excel during an unattended run.
An Automation runbook sounds like the right direction. I will investigate the application permissions and consent requirements for each tenant, then adapt the script so it produces a combined result instead of opening a file after every run.
That is the part I was hoping to avoid. I was hoping the existing GDAP relationships from the partner tenant would allow the script to switch tenants without another sign-in, but it sounds like I may need separate application consent or another automation design.