To connect your Microsoft cloud account to Labra, you’ll need to run a one-time setup script in Azure. This script creates the required app registration in your tenant and generates the values you’ll later paste into Labra.
This process must be completed by an Azure Admin (Global Administrator).
➡️ Step 1: Open Azure Cloud Shell
- Sign in to the Azure Portal.
- At the top navigation bar, click the Cloud Shell icon.
- The first time you open Cloud Shell, Azure will prompt you to choose an environment.
- Select Bash (not PowerShell).
- If you have multiple subscriptions, choose the subscription your organization uses for Microsoft Marketplace operations.
Wait for the Cloud Shell environment to initialize.
➡️ Step 2: Upload or Paste the Script
You can run the script in one of two ways:
Option A- Upload the script file
- Download the script from Labra.
In Cloud Shell, click the Upload icon and upload the file.
Run it using:
$ bash ./path-to-file/<script-name>.sh
Option B- Copy/paste directly
- Open the script file from Labra.
- Copy its entire contents.
- Paste it directly into Cloud Shell and press Enter.
⚠️ Both methods produce the same result.
➡️ Step 3: Enter Your Target Tenant ID
The script will ask you for the Tenant ID of the organization you’re connecting.
- This is the Azure AD tenant tied to your Microsoft Marketplace presence.
- Your Azure admin should know this value already.
- Paste the Tenant ID when prompted and hit Enter.
➡️ Step 4: Authenticate via Device Login
Since the script is running in a browser-based Cloud Shell session, Azure requires a device login.
- The script will show a short code and a link.
- Open the link in a new tab, enter the code, and sign in using your Azure admin account.
- Once authenticated, return to Cloud Shell and the script will continue automatically.
⚠️ If you run the script locally from your terminal, this step is skipped
➡️ Step 5: Name Your App Registration
The script will ask whether you would like to use the default app name:
Marketplace Partner Center Application
- Press Enter to accept the default, or
- Type a custom name if your organization prefers one.
This app will act as the identity used to fetch Microsoft Marketplace revenue and offer data for your tenant.
➡️ Step 6: Wait for the Script to Complete (≈1 minute)
The script automatically:
- Creates the Azure AD App Registration
- Generates the Client ID
- Generates the Client Secret
- Assigns the necessary Partner Center and Marketplace permissions
Once complete, it will display the values you need.
➡️ Step 7: Copy the Output
The script outputs:
- Tenant ID
- Client ID
- Client Secret
- Additional copy the display name
- This is the connection name
Admins can review these to ensure the correct scopes are applied.
⚠️ Copy these values and paste them into Labra’s Microsoft onboarding page.
➡️ Step 8: Complete the Required Manual Step
After running the script, Azure requires one final manual action:
You must add the generated App Registration as a user in Microsoft Partner Center / Marketplace.
- This is a Microsoft requirement.
- It cannot be automated (Microsoft does not provide APIs for this).
- The Azure admin and Marketplace admin may need to be on the same call if these roles are separate.
This step links your Azure AD app to Microsoft Marketplace so Labra can access offer and revenue data for your tenant.
Who Should Perform This?
- This process should be completed by an Azure Admin.
- It is not something non-technical users or marketers need to do.
- The script is designed to be run once per tenant.
⚠️ Client Secrets can be rotated in the future if needed.
FAQs
- Why do I need to run a script?
Microsoft requires ISVs/resellers to create a single-tenant App Registration so Marketplace and revenue data remains isolated to your account. - Can this be done automatically through a single sign-on button?
No. Azure Cloud Shell cannot be launched from a UI link, and Microsoft does not provide APIs to create or link this app registration automatically. - What if we sell through a reseller who already completed this setup?
Your reseller can provide their credentials and you skip this entire process.