title: Azure multi-tenant OAuth 20.0 app Web API scenario consent via portal
body: <p>There is a Client in Tenant A. There is a Resource Server (<code>Web API</code>) in Tenant B. I'm developing both <code>Client</code> and <code>Web API</code>. I'm admin in both Tenant A and B. <code>OAuth 2.0</code> grant type is Client Credentials so no <code>End-User</code>is involved. My Web API (<code>AAD App</code>) exposes AppRoles which I described in <code>Web API (AAD App)</code> manifest (I named one of them <code>client_access</code>). For both <code>AAD Apps</code>(<code>Client</code> and <code>Web API</code>) I turned on multi-tenant option. And they have globally unique App ID URIs.</p>
  
  <p>Now Client <code>(AAD App</code>) wants to request permissions to access <code>Web API</code>in this role (<code>client_access</code>). Because they are in different tenants I created a Service Principal representing the Client in Tenant B. Now I want that Admin of Tenant B would provide this Service Principal with permissions/consent on requested role client_access providing by <code>Web API</code>.</p>
  
  <p>But how (being an Admin of a Tenant) using <code>Azure Portal</code>can I find this Service Principal? App registration page shows only <code>AAD Apps</code>but not Service Principals. I don't see Client<code>AAD App</code>either (in App registration page in Tenant B). </p>
  
  <p>With single tenant situation everything is easy -- I select Client, go to Required permission section, push <code>Add button</code>, find there my <code>Web API</code>and check <code>client_access checkbox</code>, then I push button Grant Permissions to provide my consent.</p>
  
  <p><strong>Anyone have a clue on How to provide permissions for Client to access Web API in multi-tenant scenario using Azure Portal or PowerShell or other means?</strong> 
  Maybe my overall approach is wrong? So advice please.</p>
  
  <p>P.S.
  We will publish/expose this <code>Web API</code>to many of our partners so they  will be able to develop their own Clients (residing in their tenants). They will requests access and I will grant/consent/approve their requests to my <code>Web API</code>. And after permission is established the Clients will communicate with <code>Web API</code>using <code>OAuth 2.0</code> Client Credentials grant type with an access token.</p>
  
  <p>Thank you</p>