|
| 1 | +--- |
| 2 | +title: Create MCA subscriptions across associated tenants |
| 3 | +description: Learn how to programmatically create Azure subscriptions across associated Microsoft Entra tenants, including steps and considerations. |
| 4 | +author: bandersmsft |
| 5 | +ms.service: cost-management-billing |
| 6 | +ms.subservice: billing |
| 7 | +ms.topic: how-to |
| 8 | +ms.date: 01/14/2025 |
| 9 | +ms.reviewer: rygraham |
| 10 | +ms.author: banders |
| 11 | +#customer intent: Learn how to programmatically create Azure Microsoft Customer Agreement (MCA) subscriptions across associated Microsoft Entra tenants, including necessary steps and considerations. |
| 12 | +--- |
| 13 | + |
| 14 | +# Programmatically create MCA subscriptions across associated Microsoft Entra tenants |
| 15 | + |
| 16 | +This article helps you programmatically create a Microsoft Customer Agreement (MCA) subscription across [associated billing tenants](manage-billing-across-tenants.md). In some situations, you might need to create MCA subscriptions across Microsoft Entra tenants but tie them to a single billing account. Examples of such situations include: |
| 17 | + |
| 18 | +- SaaS providers wanting to segregate hosted customer services from internal IT services |
| 19 | +- Holding or venture capital companies with many portfolio companies |
| 20 | +- Internal environments that have strict regulatory compliance requirements, like Payment Card Industry (PCI) |
| 21 | + |
| 22 | +The process to create an MCA subscription in associated billing tenants requires actions to be taken in the source and destination Microsoft Entra tenants. This article uses the following terminology: |
| 23 | + |
| 24 | +- Source Microsoft Entra tenant (source.onmicrosoft.com). It represents the source tenant where the MCA billing account exists. |
| 25 | +- Destination Cloud Microsoft Entra tenant (destination.onmicrosoft.com). It represents the destination tenant where the new MCA subscriptions are created. |
| 26 | + |
| 27 | +You can't create support plans programmatically. You can buy a new support plan or upgrade one in the Azure portal. Navigate to **Help + support**. At the top of the page, select **Choose the right support plan**. |
| 28 | + |
| 29 | +> [!NOTE] |
| 30 | +> There are two methods to enable programmatically creating MCA subscriptions across Microsoft Entra tenants. The method outlined in this article is a simplified version which minimizes the management overhead and streamlines the subscription creation process by transferring permissions to create MCA subscriptions entirely to the destination tenant. |
| 31 | +> The other method involves a [two-phase process](programmatically-create-subscription-microsoft-customer-agreement-across-tenants.md) which provides the source tenant governance over the subscriptions created in destination tenants. This method might be preferred if you need tighter control over creating subscriptions in destination tenants. |
| 32 | +
|
| 33 | +## Prerequisites |
| 34 | + |
| 35 | +The following environment is required in order to enable programmatic creation of MCA subscriptions across associated billing tenants: |
| 36 | + |
| 37 | +- A source Microsoft Entra tenant with an active [Microsoft Customer Agreement](create-subscription.md) billing account. If you don't have an active MCA, you can create one. For more information, see [Azure - Sign up](https://signup.azure.com/) |
| 38 | +- A destination Microsoft Entra tenant separate from the tenant where your MCA belongs. To create a new Microsoft Entra tenant, see [Microsoft Entra tenant setup](../../active-directory/develop/quickstart-create-new-tenant.md). |
| 39 | +- Add the destination Microsoft Entra tenant as associated billing tenant [associated billing tenants](manage-billing-across-tenants.md) within the source Microsoft Entra tenant and assign billing roles to a user from the destination Microsoft Entra tenant. |
| 40 | + |
| 41 | +## Application setup |
| 42 | + |
| 43 | +Use the information in the following sections to set up and configure the needed application in the destination tenant. |
| 44 | + |
| 45 | +### Register an application in the destination tenant |
| 46 | + |
| 47 | +To programmatically create an MCA subscription, a Microsoft Entra application must be registered and granted the appropriate Azure role-based access control (RBAC) permission. For this step, ensure you're signed into the destination tenant (destination.onmicrosoft.com) with an account that has permissions to register Microsoft Entra applications. Also make sure it was assigned a billing role in the source tenant (source.onmicrosoft.com) as part of the prerequisites. |
| 48 | + |
| 49 | +Following the steps in [Quickstart: Register an application with the Microsoft identity platform](../../active-directory/develop/quickstart-register-app.md). |
| 50 | + |
| 51 | +For the purposes of this process, you only need to follow the [Register an application](../../active-directory/develop/quickstart-register-app.md#register-an-application) and [Add credentials](../../active-directory/develop/quickstart-register-app.md#add-credentials) sections. |
| 52 | + |
| 53 | +Save the following information to test and configure your environment: |
| 54 | + |
| 55 | +- Directory (tenant) ID |
| 56 | +- Application (client) ID |
| 57 | +- Object ID |
| 58 | +- App secret value that was generated. The value is only visible at the time of creation. |
| 59 | + |
| 60 | +### Create a billing role assignment for the application in the destination tenant |
| 61 | + |
| 62 | +To determine the appropriate scope and [billing role](understand-mca-roles.md#subscription-billing-roles-and-tasks) for the application, review the information at [Understand Microsoft Customer Agreement administrative roles in Azure](understand-mca-roles.md). |
| 63 | + |
| 64 | +A user with owner access can assign a role to the application by signing into the Azure portal in the associated tenant. Owner access includes: |
| 65 | + |
| 66 | +- Billing account owner |
| 67 | +- Billing profile owner |
| 68 | +- Invoice section owner |
| 69 | + |
| 70 | +After you determine the scope and role, use the information at [Manage billing roles in the Azure portal](understand-mca-roles.md#manage-billing-roles-in-the-azure-portal) to create the role assignment for the application. Search for the application by using the name that you used when you registered the application in the preceding section. |
| 71 | + |
| 72 | +## Programmatically create a subscription |
| 73 | + |
| 74 | +With the applications and permissions already set up, use the following information to programmatically create subscriptions. |
| 75 | + |
| 76 | +### Create the subscription |
| 77 | + |
| 78 | +Use the following information to create a subscription in the destination tenant. |
| 79 | + |
| 80 | +#### Get a destination application access token |
| 81 | + |
| 82 | +Replace the `{{placeholders}}` with the actual tenant ID, application (client) ID, and the app secret values that you saved when you created the destination tenant application previously. |
| 83 | + |
| 84 | +Invoke the request and save the `access_token` value from the response for use in the next step. |
| 85 | + |
| 86 | +```http |
| 87 | +POST https://login.microsoftonline.com/{{tenant_id}}/oauth2/token |
| 88 | +Content-Type: application/x-www-form-urlencoded |
| 89 | +
|
| 90 | +grant_type=client_credentials&client_id={{client_id}}&client_secret={{app_secret}}&resource=https%3A%2F%2Fmanagement.azure.com%2F |
| 91 | +``` |
| 92 | + |
| 93 | +#### Get the billing account, profile, and invoice section IDs |
| 94 | + |
| 95 | +Use the information at [Find billing accounts that you have access to](programmatically-create-subscription-microsoft-customer-agreement.md?#find-billing-accounts-that-you-have-access-to) and [Find billing profiles & invoice sections to create subscriptions](programmatically-create-subscription-microsoft-customer-agreement.md?#find-billing-profiles--invoice-sections-to-create-subscriptions) sections to get the billing account, profile, and invoice section IDs. |
| 96 | + |
| 97 | +> [!NOTE] |
| 98 | +> We recommend using the REST method with the access token obtained previously to verify that the application billing role assignment was created successfully in the [Application Setup](#application-setup) section. |
| 99 | +
|
| 100 | +#### Create a subscription alias |
| 101 | + |
| 102 | +With the billing account, profile, and invoice section IDs, you have all the information needed to create the subscription: |
| 103 | + |
| 104 | +- `{{guid}}`: Can be a valid GUID. |
| 105 | +- `{{access_token}}`: Access token of the destination tenant application obtained previously. |
| 106 | +- `{{billing_account}}`: ID of the billing account obtained previously. |
| 107 | +- `{{billing_profile}}`: ID of the billing profile obtained previously. |
| 108 | +- `{{invoice_section}}`: ID of the invoice section obtained previously. |
| 109 | +- `{{destination_tenant_id}}`: ID of the destination tenant as noted when you previously created the destination tenant application. |
| 110 | +- `{{destination_service_principal_object_id}}`: ID of the destination tenant service principal that you got from the [Get a destination application access token](#get-a-destination-application-access-token) section previously. |
| 111 | + |
| 112 | +```http |
| 113 | +PUT https://management.azure.com/providers/Microsoft.Subscription/aliases/{{guid}}?api-version=2021-10-01 |
| 114 | +Authorization: Bearer {{access_token}} |
| 115 | +Content-Type: application/json |
| 116 | +
|
| 117 | +{ |
| 118 | + "properties": { |
| 119 | + "displayName": "{{subscription_name}}", |
| 120 | + "workload": "Production", |
| 121 | + "billingScope": "/billingAccounts/{{billing_account}}/billingProfiles/{{billing_profile}}/invoiceSections/{{invoice_section}}", |
| 122 | + "subscriptionId": null, |
| 123 | + "additionalProperties": { |
| 124 | + "managementGroupId": null, |
| 125 | + "subscriptionTenantId": "{{destination_tenant_id}}", |
| 126 | + "subscriptionOwnerId": "{{destination_service_principal_object_id}}" |
| 127 | + } |
| 128 | + } |
| 129 | +} |
| 130 | +``` |
| 131 | + |
| 132 | +## Next steps |
| 133 | + |
| 134 | +* Now that you created a subscription, you can grant that ability to other users and service principals. For more information, see [Grant access to create Azure Enterprise subscriptions (preview)](grant-access-to-create-subscription.md). |
| 135 | +* For more information about managing large numbers of subscriptions using management groups, see [Organize your resources with Azure management groups](../../governance/management-groups/overview.md). |
| 136 | +* To change the management group for a subscription, see [Move subscriptions](../../governance/management-groups/manage.md#move-management-groups-and-subscriptions). |
0 commit comments