The Work 365 Microsoft Partner Center Integration enables Partner Center data, such as subscriptions, agreements, and provider invoices, to have a bi-directional sync with Work 365. The Microsoft Partner Center integration requires both Admin consent and User consent on the Entra tenant that hosts the Partner Center instance.

Before you begin

Microsoft Partner Center integration is applicable to direct-bill CSP Partners only. You must be a licensed Work 365 user with the Work 365 Admin security role assigned to you to create new provider connections. You must be able to login to the Entra Id tenant that hosts your Microsoft Partner Center instance with the Global Administrator role.

Step 1: Creating the Integration Account

The following steps describe the process of creating the Integration account in Microsoft Partner Center. This integration account should be a separate account, not a person within the organization. It should also be a different account from any global administrators. This integration account does not need CRM licensing as it will never be used to log in to Work 365 or Dataverse. To create the new integration account

1. Login to Microsoft Partner Center dashboard using an account with the Global Administrator role
2. In Microsoft Partner Center, click on the settings gear ⚙️in the upper right. Then choose Account settings
3. On the left-hand navigation, click User management
4. On the User management page, click on Add user and configure it as follows:
   1. Give the user a recognizable Name and email address e.g. work365integration@[yourpartnercenterdomain]
   2. In the Assists your customers as section, select Admin agent

At this point, a summary screen with a temporary password would be displayed. Use the credentials to verify access and confirm you can login using the credentials with MFA enabled.

🚧

MFA for integration user

MFA must be enabled on the Integration user. The MFA cannot be conditional and must be configured to trigger on every login

Enforce MFA for the integration account

To enforce MFA for the integration account:

1. Login to Entra Id
2. In the left hand navigation, click on Users → All Users.
3. In the command ribbon, click the Per-user MFA option.
4. Locate the integration account on the multi-factor authentication screen.
5. Check the selection checkbox next to the integration account name and click the Enable link. If this option is not visible, then MFA is already enabled - proceed to step 7.
6. Click the enable multi-factor auth button on the confirmation popup.
7. Locate the integration account once more and check the selection checkbox. Click the Enforce link.
8. Click the enforce multi-factor auth button on the confirmation popup.
9. The MULTI-FACTOR AUTH STATUS column against the integration account should now show as Enforced.

Some helpful links

• Set user password to never expire
• Enable multifactor authentication for user

Step 2: Creating the Connector

📘

This step does not apply if you're upgrading an existing partner center connection to use the new consent process

To create the new connection to Microsoft Partner Center from Work 365 follow these steps:

1. Login to Work 365 as a user with the Work 365 Admin security role.
2. Use the area selector at the bottom of the left-hand navigation to change to the Administration area, the select Admin Hub.
3. At the top of the Admin Hub, click on the Integrations tab.
4. In the upper left corner, click Add New. Then, in the list of available connectors, find the Microsoft Partner Center tile and click Create
5. Give the Partner Center Connector a name. If you operate in multiple Microsoft regions, include the region in the connector name to easily distinguish.
6. Click Save

Step3a: Global Admin Consent

To provide Global Admin consent to the Work 365 connection:

1. Login to Work 365 as a user with the Work 365 Admin security role.
2. Use the area selector at the bottom of the left-hand navigation to change to the Administration area, the select Admin Hub.
3. At the top of the Admin Hub, click on the Integrations tab.
4. If you are establishing a new connection to Partner Center, find the display name for the connector that was created in Step 2. If have an existing Partner Center connection that must be updated to use the new consent process, find that connector in the list. At the right, click on the Settings ⚙️ gear for that connector.
5. On the connector configuration page, click on Generate Admin Consent Redirect Link.
6. On the page that appears, click to copy the link for Admin Consent.
7. Switch browsers to an instance where you are logged into Microsoft Partner Center Dashboard as a Global Administrator. Paste the link in the URL bar.
8. Complete the application consent process for the Work 365 app that Microsoft displays
9. Return to Work 365. Do not click Save on the integration account yet.

Step 3b: Integration User Consent

1. Returning to the Connector configuration page after step 3a, click the option to Generate User Consent Redirect Link. If the option is not enabled, click back to list in the upper right corner of the configuration page. Do not click Save. Select the Settings⚙️ gear for the connector once more and click edit. The User Consent button should now be enabled.
2. On the page that appears, click to copy the link for User Consent.

🚧

InPrivate / Incognito Window required

It is essential to complete the following steps in Private browsing window or a new browser, so you don't confuse the system with the integration account and your own Entra identity.

3. Switch browsers to an instance where you are logged into Microsoft Partner Center Dashboard as the Integration User that was established in Step 1. Paste the link in the URL bar.
4. Complete the user consent process that Microsoft displays.

Step 3c: Finalizing the connector

Back in the connector configuration after both Admin and User consent are complete:

1. If you're creating a new connector, fill in the Reseller Authorization links that you use when connecting new customers to Partner Center.
2. Configure a Usage Mismatch Tolerance. This dollar value is the amount of acceptable difference between Microsoft's Reconciliation File and Daily Rated Usage file when they are synchronized each month. Some mismatch is expected because the two files use different decimal precision. Depending on the volume of Azure consumption data in the Daily rated usage file, this mismatch could be a fraction of a cent all the way up to $50 or even $500 dollars. Pick the amount that slightly exceeds the typical mismatch between these two files.
3. Configure the Azure discounts setting.
4. Click Save

For Customers with existing connectors for Microsoft Partner Center who have just upgraded to Work 365 PV v2.0