Bootstrapping the Secure Application Model

The bridge acts in customer tenants by exchanging a stored SAM refresh token for per-tenant Graph tokens. That token must be seeded once by an interactive, MFA'd admin agent - MFA on App+User Partner Center calls has been enforced by Microsoft since April 2026, so there is no way around the one-time human step.

Three ways to seed it

In order of preference:

1. Interactive device-code bootstrap (recommended)

dotnet run --project src/PartnerCenterBridge.Api -- bootstrap-sam

Prints a URL + code. Sign in with an MFA'd admin-agent account from your partner tenant; the bridge captures the refresh token and stores it encrypted.

2. Paste a refresh token captured out-of-band

curl -X POST /api/admin/sam/seed \
  -H 'content-type: application/json' \
  -d '{"refreshToken":"..."}'

3. Config seed

Set Partner:SeedRefreshToken in configuration; the bridge persists and rotates it on first use. Useful for infrastructure-as-code bootstraps where the token is injected as a SOPS-encrypted secret.

After seeding

Check status any time: GET /api/admin/sam/status → { "bootstrapped": true|false }.
The token is rotated automatically on every use - comfortably inside the 90-day refresh-token window, so a healthy bridge never needs re-seeding.
It is stored encrypted via ASP.NET Data Protection. The key ring (DataProtection:KeyRingPath) must persist across restarts, or the stored token becomes undecryptable and you re-bootstrap.

Treat the SAM token like a domain-admin credential for every customer. It can act across all your GDAP relationships. If it ever leaks: revoke the app's sessions in your partner tenant, rotate the app secret, and re-seed. See SECURITY.md.

Still required per customer

The token alone grants nothing in a customer tenant. Each customer additionally needs admin consent for the app and an active GDAP relationship whose roles cover the operations you use. Tenants without one show as NoDelegation in the Tenants tab.