Azure Co-Sell Setup

Connect Automatum to Microsoft Partner Center referrals. This is the Integrations → Azure Partner Center connection (Part 2 of 2). You need it to send and receive co-sell opportunities with Microsoft field sellers.

Part 2 of 2

Set up the Cloud Account (transact) app first. See Azure Integration (Start Here) for the full picture.

Co-sell uses its own app registration

Automatum uses two Azure AD apps. The Cloud Account app transacts and syncs offers (Azure Marketplace Setup). The Co-Sell app on this page is a second, dedicated app for Microsoft referrals. Register a separate app for co-sell — it needs extra API permissions and a redirect URI that the transact app does not. Set up the Cloud Account first.

Passwordless connection

Co-sell connects with Workload Identity Federation — Automatum does not create or store a client secret. You add a federated credential, enter your app and tenant IDs, then sign in once as the integration user to authorize. If your tenant cannot use federation, connect with a client secret instead (Step 3).

Delegated connection — the integration user stays

Co-sell is a delegated (App+User) connection, so the redirect URI and the integration-user sign-in are always required. Federation removes the app's secret, not the user step.

Prerequisites

Before you connect co-sell, make sure you have:

• A connected Azure Cloud Account in Automatum (Azure Marketplace Setup)
• Your Microsoft Partner Network (MPN) ID
• Referrals Admin access in Partner Center
• A co-sell-eligible solution configured in Partner Center
• Permission to register an Azure AD app
• A Global Administrator (or Privileged Role Administrator) to grant admin consent for the app

Co-sell eligibility

Your solution must reach co-sell-ready status in Partner Center before Microsoft shares referrals. See Microsoft: Configure co-sell.

MFA required from 1 April 2026

From 1 April 2026, Microsoft enforces multifactor authentication (MFA) for all App+User access to Partner Center APIs. The integration user you invite in Step 4 must sign in with MFA. This applies to both federated and secret connections. See Microsoft: Partner Center security requirements.

Step 1: Register the Co-Sell Azure AD Application

Register a dedicated app for co-sell. Keep it separate from your Cloud Account (transact) app — the co-sell app needs the extra API permissions and redirect URI below.

1. Sign in to the Azure Portal.
2. Go to Microsoft Entra ID > App registrations.
3. Click New registration and enter:
   • Name: <Your Company> Co-Sell App
   • Supported account types: Accounts in this organizational directory only (Single tenant)
   • Redirect URI: platform Web, value https://api.automatum.io/integration/azure-partner-center/callback
4. Copy the Application (client) ID and Directory (tenant) ID from the Overview page.

Use the Web platform for the redirect URI

Add the redirect URI under Authentication > Add a platform > Web. Do not use Single-page application — the authorize step then fails with "endpoint only accepts POST" (AADSTS900561).

Step 2: Add API Permissions and Grant Admin Consent

Co-sell uses delegated Partner Center permissions. Automatum calls the Partner Center Referrals API as the integration user you create in Step 4.

1. In your app registration, open API permissions.
2. Click Add a permission > APIs my organization uses.
3. Add each of these permissions:

API	App (client) ID	Permission	Type
Microsoft Graph	—	User.Read	Delegated
Microsoft Partner	4990cffe-04e8-4e8b-808a-1175604b879f	user_impersonation	Delegated
Microsoft Partner Center	fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd	user_impersonation	Delegated

Cannot find the API by name

Search by the application (client) ID shown in the table above. "Microsoft Partner" can also appear as "Microsoft Dev Center", and fa3d9a0c… may not resolve to a friendly name — paste the ID.

4. For each API, select Delegated permissions, check the permission (user_impersonation, or User.Read for Microsoft Graph), then click Add permissions.

Now grant admin consent so users are never prompted:

5. Back on the API permissions page, above the Configured permissions list, click Grant admin consent for [your organization] (next to + Add a permission).
6. In the confirmation dialog, click Yes.
7. Confirm the Status column shows a green check Granted for [your organization] for every permission.

Admin consent is required

Only a Global Administrator or Privileged Role Administrator can grant admin consent. Without it, the connection fails with an insufficient-privileges or consent error.

Step 3: Add a Federated Credential

1. In the app registration, open Certificates & secrets.
2. Select the Federated credentials tab.
3. Click Add credential and set the scenario to Other issuer.
4. Enter the Issuer, Subject identifier, Name, and Audience that Automatum shows on the Integrations → Azure Partner Center card, then click Add.

Production reference values

On the production platform (app.automatum.io) the federated credential uses these values. The Integrations → Azure Partner Center card always shows the exact values to copy, but you can confirm them here:

Field	Value
Issuer	https://api.automatum.io
Subject identifier	automatum
Audience	api://AzureADTokenExchange
Name	automatum

Copy the values exactly

Azure matches the incoming token on Issuer, Subject, and Audience. A single extra space breaks the connection. Use the copy button in Automatum for each field.

Using a client secret instead? Set the redirect URI too

Workload Identity Federation is the default and needs no secret. If your tenant cannot use federation, you can connect the co-sell app with a client secret instead:

1. In Certificates & secrets, open the Client secrets tab.
2. Click New client secret, set an expiry, then copy the Value.
3. Confirm the Web redirect URI from Step 1 is set — a secret-based connection needs it. Copy the exact value Automatum shows on the Integrations → Azure Partner Center card.
4. Paste the secret into Automatum when it asks.

A client secret expires; you must rotate it before the expiry date. Federation does not expire, so prefer it. If you connect with a secret and later want to go passwordless, use Switch to federated in Automatum — it verifies a federated connection, then removes the stored secret.

Step 4: Create the Integration User

Create a dedicated integration user in your Partner Center — a service account, not a personal mailbox. You sign in as this user in Step 5 so Automatum can read and write referrals on your behalf.

1. Sign in to Partner Center. You must be an owner, manager, or global admin.
2. Go to Settings > User management.
3. Click Add user and create a new user (for example, cosell-integration@yourcompany.com).

4. Assign the Referrals Admin role (scoped to your entire organization).

5. Click Save, then set a password you can use to sign in at Step 5.

Step 5: Connect in Automatum

1. In Automatum, go to Settings > Integrations > Azure Partner Center.
2. Enter the Application (Client) ID and Directory (Tenant) ID. Leave the client secret blank for a federated (passwordless) connection.
3. Click Connect. Sign in with the integration user you created in Step 4.
4. Review the requested permissions, then click Accept.
5. Return to Automatum and click Test connection.

Permissions can take time

Partner Center permission changes can take up to 24 hours to apply. If the test fails right after setup, wait and try again.

Step 6: Add Co-Sell Solutions

1. In Partner Center, open your co-sell-eligible solution.
2. Copy the Solution Name and Solution ID.
3. In Automatum, add the solution under Integrations → Azure Partner Center.

What Automatum Syncs

• Referrals you send to Microsoft
• Referrals Microsoft shares with you
• Opportunity status updates
• Solution mapping for co-sell deals

See Co-Sell Overview for how to manage opportunities.

Troubleshooting

Authorize Fails

• Confirm you signed in with the dedicated integration user from Step 4, not your own account.
• Confirm the user has the Referrals Admin role.
• Confirm you granted admin consent for the app permissions (Step 2).

No Matching Federated Identity (AADSTS70021)

• Confirm the Issuer, Subject identifier, and Audience match Automatum exactly.
• Confirm the Audience is api://AzureADTokenExchange.

Referrals Not Appearing

• Confirm your solution is co-sell-ready in Partner Center.
• Wait up to 24 hours for permissions to apply.
• Confirm the Solution ID in Automatum matches Partner Center.

Connection Stops Working (Re-authorization)

• A co-sell connection depends on the integration user's stored session. It can expire — for example after the 1 April 2026 MFA change, a disabled user, or long inactivity.
• To fix, open Integrations → Azure Partner Center, click Connect (or Re-sync), and sign in again as the integration user.
• Federation removes the client secret, not this sign-in — the integration user is always required.

Need Help?

Contact hello@automatum.io or use the in-app chat for help with Azure co-sell.