[azure-eventhub] Enable cross-tenant support

[zmoog]

Context

The current version of the azure-eventhub input works as documented when the Event Hub and storage account reside in the same tenant as the service principal.

However, we are seeing a need for cross-tenant access. Specifically, users want to access resources across different tenants while centralizing their credentials/app definition in a single "main" tenant.

Goal

• Validate which versions of the azure-eventhub input support this scenario, if any.
• Identify any functional gaps and track them in a dedicated issue.
• Provide a detailed guide on configuring a multi-tenant setup.

Impact

A multi-tenant setup enables users to streamline log ingestion across multiple tenants using a single set of credentials. This reduces the overhead of managing multiple app registrations.

[elasticmachine]

Pinging @elastic/obs-ds-hosted-services (Team:obs-ds-hosted-services)

[zmoog]

I successfully set up the following multi tenant scenario between tenant t1 and tenant t2.

• (t1) Created an app registration
• (t1) Created a client secret
• (t2) Gave consent to access the app registration on t1, which created an enterprise app on t2
• (t2) Granted 'Azure Event Hubs Data Receiver' to enterprise app
• (t2) Granted 'Storage Blob Data Contributor' to enterprise app

Then I set up Filebeat with the following config:

filebeat.inputs:
- type: azure-eventhub
  enabled: true

  auth_type: "client_secret"

  tenant_id: "t2-tenant"
  client_id: "t1-client-id"
  client_secret: "t1-client-secret"

  # Event Hub configuration
  eventhub: "${EVENTHUB_NAME}"
  eventhub_namespace: "${EVENTHUB_NAMESPACE}"

  # Azure Storage configuration for checkpointing
  storage_account: "${STORAGE_ACCOUNT}"

  # Optional settings
  processor_version: v2
  transport: websocket