Azure CSP Root Tenant Manual CLI Onboarding

Azure CSP Root Tenant CLI Onboarding

You can onboard all subscriptions as a group by following the CLI steps provided below

Why this matters: a CSP relationship is managed through a Root Tenant / Management Group rather than a standard subscription ID — so the app registration and role assignments here happen once at that management-group scope, pulling in every subscription underneath it, instead of being repeated per subscription.

If you have already set up the Root Tenant for billing using the steps provided here Azure CSP onboarding Root Tenant as Billing you can utilize the same credentials to onboard the Root Tenant again.

To manage a Microsoft Entra ID app and create a client secret, the Microsoft Entra ID Application Administrator role is required

Create Microsoft Entra ID app

az ad sp create-for-rbac --display-name "<APP_NAME>" --years=2 -o table

<APP_NAME>: Enter the unique name. Recommended (digitalex_root_tenant)
Capture App id and share it with Owner required to Assign Permissions to the App
Capture Password (Secret) and Tenant id required to Connect Management Group

To assign permissions to the Microsoft Entra ID app, it is recommended to have the Owner role. Alternatively, you can have both the Contributor and User Access Administrator roles.

Assign Permissions to the App

az role assignment create --assignee "<APP_ID>" --role "Reader" --scope "/providers/Microsoft.Management/managementGroups/<MANAGEMENT_GROUP-ID>" -o table

<APP_ID> : Enter App id created in above step
<MANAGEMENT_GROUP-ID>: Enter your management group Id(To Get Management Group id Navigate to Azure Console > Search Management Group > Capture tenant group id)

Connect Root Tenant

Login to Mavvrik
Go to Menu > Admin > Public Clouds
Click on +Management Groups & Enter required details
Click Connect.

Troubleshooting

The Root Tenant does not connect or the expected subscriptions are not covered

Check the App ID, password (client secret), and Tenant ID against the output from the application-creation step. Keep these values associated with the same application.
Verify that MANAGEMENT_GROUP-ID identifies the management group you intended to onboard.
Confirm that the Reader assignment targets that application at /providers/Microsoft.Management/managementGroups/<MANAGEMENT_GROUP-ID>.
Review the Root Tenant connection details entered in Mavvrik. If you reused credentials from billing onboarding, confirm that they belong to the intended application and management-group scope.