diff --git a/services/tunnelbroker/src/config.rs b/services/tunnelbroker/src/config.rs
--- a/services/tunnelbroker/src/config.rs
+++ b/services/tunnelbroker/src/config.rs
@@ -1,8 +1,11 @@
 use crate::constants;
-use crate::constants::{ENV_APNS_CONFIG, ENV_FCM_CONFIG, ENV_WEB_PUSH_CONFIG};
+use crate::constants::{
+  ENV_APNS_CONFIG, ENV_FCM_CONFIG, ENV_WEB_PUSH_CONFIG, ENV_WNS_CONFIG,
+};
 use crate::notifs::apns::config::APNsConfig;
 use crate::notifs::fcm::config::FCMConfig;
 use crate::notifs::web_push::config::WebPushConfig;
+use crate::notifs::wns::config::WNSConfig;
 use anyhow::{ensure, Result};
 use clap::Parser;
 use comm_lib::aws;
@@ -43,6 +46,10 @@
   #[arg(env = ENV_WEB_PUSH_CONFIG)]
   #[arg(long)]
   pub web_push_config: Option<WebPushConfig>,
+  /// WNS secrets
+  #[arg(env = ENV_WNS_CONFIG)]
+  #[arg(long)]
+  pub wns_config: Option<WNSConfig>,
 }
 
 /// Stores configuration parsed from command-line arguments
diff --git a/services/tunnelbroker/src/main.rs b/services/tunnelbroker/src/main.rs
--- a/services/tunnelbroker/src/main.rs
+++ b/services/tunnelbroker/src/main.rs
@@ -11,6 +11,7 @@
 use crate::notifs::apns::APNsClient;
 use crate::notifs::fcm::FCMClient;
 use crate::notifs::web_push::WebPushClient;
+use crate::notifs::wns::WNSClient;
 use crate::notifs::NotifClient;
 use anyhow::{anyhow, Result};
 use config::CONFIG;
@@ -88,10 +89,13 @@
     }
   };
 
+  let wns_config = CONFIG.wns_config.clone();
+
   let notif_client = NotifClient {
     apns,
     fcm,
     web_push,
+    wns: None,
   };
 
   let grpc_server = grpc::run_server(db_client.clone(), &amqp_connection);
diff --git a/services/tunnelbroker/src/notifs/mod.rs b/services/tunnelbroker/src/notifs/mod.rs
--- a/services/tunnelbroker/src/notifs/mod.rs
+++ b/services/tunnelbroker/src/notifs/mod.rs
@@ -1,14 +1,17 @@
 use crate::notifs::apns::APNsClient;
 use crate::notifs::fcm::FCMClient;
 use crate::notifs::web_push::WebPushClient;
+use crate::notifs::wns::WNSClient;
 
 pub mod apns;
 pub mod fcm;
 pub mod web_push;
+pub mod wns;
 
 #[derive(Clone)]
 pub struct NotifClient {
   pub(crate) apns: Option<APNsClient>,
   pub(crate) fcm: Option<FCMClient>,
   pub(crate) web_push: Option<WebPushClient>,
+  pub(crate) wns: Option<WNSClient>,
 }
diff --git a/services/tunnelbroker/src/notifs/wns/config.rs b/services/tunnelbroker/src/notifs/wns/config.rs
new file mode 100644
--- /dev/null
+++ b/services/tunnelbroker/src/notifs/wns/config.rs
@@ -0,0 +1,16 @@
+use serde::{Deserialize, Serialize};
+use std::str::FromStr;
+
+#[derive(clap::Args, Clone, Debug, Deserialize, Serialize)]
+pub struct WNSConfig {
+  pub tenant_id: String,
+  pub app_id: String,
+  pub secret: String,
+}
+
+impl FromStr for WNSConfig {
+  type Err = serde_json::Error;
+  fn from_str(s: &str) -> Result<Self, Self::Err> {
+    serde_json::from_str(s)
+  }
+}
diff --git a/services/tunnelbroker/src/notifs/wns/mod.rs b/services/tunnelbroker/src/notifs/wns/mod.rs
new file mode 100644
--- /dev/null
+++ b/services/tunnelbroker/src/notifs/wns/mod.rs
@@ -0,0 +1,6 @@
+pub mod config;
+
+#[derive(Clone)]
+pub struct WNSClient {
+  http_client: reqwest::Client,
+}