Azure Monitor Alert Multi-Tenant Secure Webhook

Question

Azure Monitor Alert Multi-Tenant Secure Webhook

Mathias Sundman 55

Is it possible to have an Azure Monitor action group action use a Secure Webhook to call an EntraID authenticated Azure Function in a different tenant? As long as my Azure Function is in the same tenant, I can successfully select the ObjectID of my Function App's App Registration in the Action Group configuration after making myself owner of that application. However if I create the function app in a different tenant as a Multi-Tenant app and request admin consent from my parent tenant with Azure Monitor, it only appears as an Enterprise App, not as an App Registration, so I'm unable to make myself owner of the application, and therefor unable to select it in the Azure Monitor action group. Why this "Owner" restriction? Wouldn't it make sense to be able to use a cross-tenant authenticated Secure Webhook?

Ross Aveling 0 Reputation points

2025-04-23T15:45:08.2366667+00:00

I'm looking to have Azure Monitor alerts be sent to a Logic App in another tenant using a Secure Webhook and would also like to voice my frustration that this isn't currently possible.

It certainly isn't a security concern as users are already able to configure a [non-Secure] webhook that can point anywhere!
Schroeder, Michael (CTR) 41 Reputation points

2025-04-23T17:22:59.0233333+00:00

As a follow-up here, it is possible to achieve this. For the specific question, you just need to create your App Registration in the same tenant as the action group, then use that App Registration for authentication (cross tenant) in your function app. You can't just select it in the portal...but then you should be deploying using IaC right? ;-) So you just put the correct ID in your deployment code.

Where it gets wonky is if you are setting up multi-tenant alert processing. I ended up creating an App Registration / Service Principal in each tenant, then creating two function apps (sharing the same ASP) in the target tenant that runs alert processing. The only difference between the function apps is the App Registration/Service Principal used for authentication of the call. Both apps load their code from the same ZIP file in storage account blob (thus any code updates are made in only one place). Ugly, but it works and will support as many tenants as needed -- at least until Microsoft figures out a better way to fix the security bug they are patching with the "owner" restriction.

3 answers

Your answer

Ross Aveling 0 Reputation points

2025-04-23T15:45:08.2366667+00:00

I'm looking to have Azure Monitor alerts be sent to a Logic App in another tenant using a Secure Webhook and would also like to voice my frustration that this isn't currently possible.

It certainly isn't a security concern as users are already able to configure a [non-Secure] webhook that can point anywhere!
Schroeder, Michael (CTR) 41 Reputation points

2025-04-23T17:22:59.0233333+00:00

As a follow-up here, it is possible to achieve this. For the specific question, you just need to create your App Registration in the same tenant as the action group, then use that App Registration for authentication (cross tenant) in your function app. You can't just select it in the portal...but then you should be deploying using IaC right? ;-) So you just put the correct ID in your deployment code.

Where it gets wonky is if you are setting up multi-tenant alert processing. I ended up creating an App Registration / Service Principal in each tenant, then creating two function apps (sharing the same ASP) in the target tenant that runs alert processing. The only difference between the function apps is the App Registration/Service Principal used for authentication of the call. Both apps load their code from the same ZIP file in storage account blob (thus any code updates are made in only one place). Ugly, but it works and will support as many tenants as needed -- at least until Microsoft figures out a better way to fix the security bug they are patching with the "owner" restriction.

Answer 1

I'm sorry to be blunt, but this really sounds like a bug. Instead of fixing the actual problem, it sounds like the product group put a patch on that prevents customers from designing multi-tenant alert handling solutions, with a centralized function-app able to handle alert processing from all owned tenants.

Please fix the bug instead of putting a security restriction in place that won't allow us to design efficient alert handling.

Yes, we need to be secure, and I applaud that. But I am concerned when the answer is other customers can all our App Registrations with a Secure Webhook unless an "owner" check is put in place.

Answer 2

Hello @Mathias Sundman

The “Owner” restriction you’re encountering is due to how Azure handles permissions and security across tenants. When you create an Azure Function in a different tenant as a Multi-Tenant app, it appears as an Enterprise App in the parent tenant because it’s considered a service provided by another tenant.

Admin consent in Azure is designed to protect the data and resources of a tenant. It’s a mechanism that ensures only authorized administrators can grant permissions to applications, especially when those applications request access to sensitive data or resources.

In the case of a multi-tenant application, admin consent can only be provided for the tenant where the application is registered in the first place1.

Users or Administrators of other tenants cannot consent via Azure Portal. It has to be done either when a user/administrator accesses the multi-tenant application for the first time, or by constructing the Admin Consent URL and sharing it with the Administrators of the other tenants.

As for Azure Monitor action groups, they are designed to work within the context of a single tenant. The “Owner” restriction ensures that the person configuring the action group has the necessary permissions to access and manage the resources involved. While it might seem logical to use a cross-tenant authenticated Secure Webhook, it would introduce complexities around security, data privacy, and compliance. Each tenant in Azure is a boundary that isolates access to resources and data. Allowing cross-tenant access would require careful management of these aspects.

However, your feedback about the “Owner” restriction and the desire for cross-tenant authenticated Secure Webhooks is valuable. I recommend providing this feedback directly to Microsoft through their UserVoice or feedback forums. We are always here for ways to improve their services based on user needs.

If this information provided here helps solve your issue, please tag this as answered, so it helps further community readers, who may have similar questions.

Answer 3

Ryan Hill 30,496 Microsoft Employee Moderator

Apologies for the late reply @Mathias Sundman. I've reached out to the product group regarding your specific issue. That limitation is by design and there isn't a work around. The reasoning behind it addresses a security concern. Without checking the ownership, anyone can configure a securewebhook action under his/her action group that's pointing to another customer's securewebhook. This can allow them to take advantage of the action Group to make http call to the webhook service.

Ross Aveling 0 Reputation points

2026-10-08T15:10:29.09+00:00

This situation is ridiculous and the ownership mechanism impemented is clearly wrong. Fair enough, check that users are owners to ensure security is upheld but the check should be made against Enterprise Application ownership, not that of the App Registration (which, as already mentioned, doesn't exist in consenting tenants).

I've just upgraded our monitoring processing solution to be multi-tenant, specifically to avoid per-tenant deployments, and only discovered this quirk at the 11th hour.

Crazy.