Sometimes there’s a need to grant a group in another Entra domain access to something within your Microsoft Azure. The advantage to this, specifically for when the other Entra domain is a vendor, is that you can grant access to the group and let the vendor manage the group membership, so that as new members of the team are onboarded, the vendor can just put them into the group that you’ve given rights to Azure, and there’s nothing else to be done on your side.
However, the Azure portal doesn’t give you a way to grant rights to a remote group via the website, but you can using the AZ CLI. To do this in the CLI, you’ll need two IDs: one from the Azure portal and one from the remote Entra. The ID that you’ll need from the Azure Portal that you’ll need is the Resource ID of the object that you’ll be giving rights to. The one from the remote Entra is the ID of the group that you’ll be giving access to. You’ll also need the name of the role that you want to grant, such as Reader, Owner, etc.
az role assignment create --role "<Role>" --assignee-object-id "<Remote Entra Group Id>" --assignee-principal-type "ForeignGroup" --scope "<Resource ID>"Once this is done, give Azure a minute for the change to propagate, and once done, the remote members of the group will have the specified access.
Denny