• I have a Microsoft PAL (Microsoft Partner Admin Link) that I need to assign to about a dozen service principals (e.g. app registrations) in Azure
• This needs to be done during automated CI/CD pipeline (script running on a headless server)
• It needs to be repeatable

How can I accomplish this? I have tried several methods, including code below, but not getting anywhere. I believe the service principal may need a billing admin role of sorts for a given subscription. E.g. custom role for Microsoft.Billing/operations/action in scope /subscriptions//providers/Microsoft.Billing/billingAccounts/default/providers/Microsoft.Billing/operations/linkPartner – but I am not sure.

What I have so far (suggested by AI) and I don’t think this is a good approach:

`
$partnerId = “”

$tenantId = "" 
$clientId = "" 
$clientSecret = "" # this would obviously come from a keyvault
$subscriptionId = "" 

$body = @{ 
    grant_type    = "client_credentials" 
    client_id     = $clientId 
    client_secret = $clientSecret 
    resource      = "https://management.azure.com/" 
} 

$tokenResponse = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$tenantId/oauth2/token" -Body $body 

$accessToken = $tokenResponse.access_token 

$headers = @{ 
    Authorization = "Bearer $accessToken" 
    "Content-Type" = "application/json" 
} 

$body = @{ 
    partnerId = $partnerId 
} | ConvertTo-Json 

$uri = "https://management.azure.com/subscriptions/$subscriptionId/providers/Microsoft.Billing/billingAccounts/default/providers/Microsoft.Billing/operations/linkPartner?api-version=2020-05-01" 

Invoke-RestMethod -Method Post -Uri $uri -Headers $headers -Body $body

`

The last line results in either 404 error, or an error if SP doesn’t have Billing write authorization.