Security requirements for using Partner Center or Partner Center APIs

Applies to

  • All partners in the Cloud Solution Provider program
  • All Control Panel Vendors
  • All Advisors

Appropriate users

  • All enabled users including guest users

This article explains the mandatory security requirements for Advisors, Control Panel Vendors, and partners participating in the Cloud Solution Provider program, as well as authentication options and other security considerations. Privacy safeguards and security are among our top priorities. We know that the best defense is prevention and that we are only as strong as our weakest link. That is why we need everyone in our ecosystem to act and ensure appropriate security protections are in place.

Mandatory security requirements

Partners who do not implement the mandatory security requirements will not be able to transact in the Cloud Solution Provider program or manage customer tenants leveraging delegated admin rights. In addition, partners who do not implement the security requirements may put their participation in programs at risk. The terms associated with the partner security requirements have been added to the Microsoft Partner Agreement. As it relates to Advisors, the same contractual requirements will be in place.

To protect you and your customers, we are requiring partners to take the following actions immediately:

  1. Enable multi-factor authentication (MFA) for all user accounts in your partner tenant. You must enforce MFA on all user accounts in your partner tenant(s). Users must be challenged by MFA when they sign in to Microsoft commercial cloud services or when they transact in the Cloud Solution Provider program through Partner Center or via APIs.

  2. Adopt the Secure Application Model framework. All partners integrating with Partner Center APIs must adopt the Secure Application Model framework for any app and user auth model applications.

    Important

    We strongly recommend that partners implement the Secure Application Model for integrating with a Microsoft API, such as Azure Resource Manager or Microsoft Graph, or when leveraging automation such as PowerShell using user credentials, to avoid any disruption when MFA is enforced.

These security requirements will help protect your infrastructure and safeguard your customers' data from potential security risks such as identify theft or other fraud incidents.

Implementing multi-factor authentication

To comply with the partner security requirements, you must implement and enforce MFA for each user account in your partner tenant. You can do this one of the way following ways:

Note

Although multi-factor authentication is not contractually required for a sovereign cloud (US Government and Germany) it is highly recommended you adopt these security requirements.

Security defaults

One of the options that partners can choose to implement MFA requirements is to enable security defaults in Azure AD. Security defaults offer a basic level of security at no extra cost. Review how to enable MFA for your organization with Azure AD and the key considerations below before enabling security defaults.

  • Partners who already adopted baseline policies need to take action to transition to security defaults.

  • Security defaults are the general availability replacement of the preview baseline policies. Once a partner enables the security defaults, they will no longer be able to enable baseline policies.

  • With security defaults, all policies will be enabled at once.

  • For partners who use conditional access, security defaults will not be available.

  • We do not block legacy authentication at this time. However, as most events related to compromised identities come from sign-in attempts using legacy authentication, partners are encouraged to move away from these older protocols.

  • Azure AD Connect synchronization account is excluded from security defaults.

For detailed information, read Overview of Azure Multi-Factor Authentication for your organization and What are security defaults?.

Note

Azure AD security defaults is the evolution of the baseline protection policies simplified. If you have already enabled the baseline protection policies, then it is highly recommended that you enable security defaults.

Implementation considerations

Because these requirements apply to all user accounts in your partner tenant, you need to consider several things to ensure a smooth deployment. For example, identify user accounts in Azure AD that cannot perform MFA, as well as applications and devices in your organization that do not support modern authentication.

Prior to performing any action, we recommend you complete the following validations.

Do you have an application or device that does not support the use of modern authentication?

When you enforce MFA, legacy authentication use protocols such as IMAP, POP3, SMTP, etc. will be blocked because they don't support MFA. To address this limitation, use the app passwords feature to ensure the application or device will still authenticate. Review the considerations for using app passwords to determine if they can be used in your environment.

Do you have Office 365 users with licenses associated with your partner tenant?

Prior to implementing any solution, we recommend that you determine what version of Microsoft Office users in your partner tenant are using. There is a chance your users will experience connectivity issues with applications like Outlook. Before enforcing MFA, it is important to ensure that you are using Outlook 2013 SP1, or later, and that your organization has modern authentication enabled. For more information, see Enable modern authentication in Exchange Online.

To enable modern authentication for devices running Windows that have Microsoft Office 2013 installed, you will need to create two registry keys. See Enable Modern Authentication for Office 2013 on Windows devices.

Is there a policy preventing any of your users from using their mobile devices while working?

It is important to identify any corporate policy that prevents employees from using mobile devices while working because it will influence what MFA solution you implement. There are solutions, such as the one provided through the implementation of Azure AD security defaults, that only allow the use of an authenticator app for verification. If your organization has a policy preventing the use of mobile devices, then consider one of the following options:

  • Deploy a time-based one-time base password (TOTP) application that can run on secure system.

  • Implement a third-party solution that enforces MFA for each user account in the partner tenant that provides the most appropriate verification option.

  • Purchase Azure Active Directory Premium licenses for the impacted users.

What automation or integration do you have to leverage user credentials for authentication?

Because we enforce MFA for each user, including service accounts, in your partner directory, this will impact any automation or integration that leverages user credentials for authentication. So, it is important that you identify which accounts are being used in these situations. See the following list of sample applications or services to consider:

  • Control panel used to provision resources on behalf of your customers

  • Integration with any platform that is used for invoicing (as it relates to the CSP program) and supporting your customers

  • PowerShell scripts that utilize the Az, AzureRM, Azure AD, MS Online, etc. modules

The above list is not comprehensive. So, it is important that you perform a complete assessment of any application or service in your environment that leverages user credentials for authentication. To contend with the requirement for MFA, you should implement the guidance in the Secure Application Model framework where possible.

Accessing your environment

To better understand what or who is authenticating without being challenged for MFA, we recommend you review the sign-in activity. Through Azure Active Directory Premium, you can leverage the sign-in report. For more information about this topic, see Sign-in activity reports in the Azure Active Directory portal. If you do not have Azure Active Directory Premium, or you are looking for a way obtain this sign-in activity through PowerShell, then you will need to leverage the Get-PartnerUserSignActivity cmdlet from the Partner Center PowerShell module.

How the requirements are enforced

Partner security requirements are enforced by Azure AD, and in turn Partner Center, by checking for the presence of the MFA claim to identify that MFA verification has taken place. Starting November 18, 2019, Microsoft activated additional security safeguards (previously known as “technical enforcement”) to partner tenants.

Upon activation, users in the partner tenant are requested to complete MFA verification when performing any admin on behalf of (AOBO) operations, accessing the Partner Center portal, or calling Partner Center APIs. For more information, see Mandating Multi-factor Authentication (MFA) for your partner tenant.

Partners who have not met the requirements should implement these measures as soon as possible to avoid any business disruptions. If you are using Azure Multi-Factor Authentication or Azure AD security defaults, there are no additional actions you need to take.

If you are using a third-party MFA solution, there is a chance the MFA claim may not be issued. If this claim is missing, Azure AD will not be able determine if the authentication request was challenged by MFA. For information on how to verify your solution is issuing the expected claim, read Testing the Partner Security Requirements.

Important

If your third-party solution does not issue the expected claim, then you will need to work with the vendor who developed the solution to determine what actions should be taken.

Resources and samples

See the following resources for support and sample code:

Next steps