Granular Delegated Admin Permissions - GDAP Overview

This article explains how Granular Delegated Admin Permissions (GDAP) impact access to customer tenants and the requirements for full functionality in Sync 365.

Microsoft Resources for GDAP

• Granular Delegated Admin Privileges (GDAP) Introduction - Microsoft Learn

• GDAP Frequently Asked Questions - Microsoft Learn

GDAP requirements for full functionality

To ensure full functionality in Sync 365, the account used to grant consent must meet these requirements:

1. Partner Center Access: The account must have access to your customers in the Partner Center.
2. GDAP Group Membership:The account must belong to a GDAP security group with these permissions:
   1. Application Administrator or Cloud Application Administrator (required for consenting the application in customer tenants).
   2. Global Reader (minimum required role unless using Global Administrator).
   3. Alternatively, Global Administrator may be used to satisfy both requirements.

Note: If you cannot assign the Application Administrator role or similar, you must manually consent to the app in each customer tenant using their Global Administrator account.

Grant Partner Center Consent (Recommended Method)

Prerequisites

Before proceeding, ensure:

• MFA is Enabled: The account must have Multi-Factor Authentication (MFA) enabled and enforced.
• Correct GDAP Group Membership: The account is part of the GDAP security group with the appropriate permissions.
• GDAP Relationships Are Established: Client tenants must have an established GDAP relationship with the security group assigned.
• Minimum Permissions: The account being used must have both:
  • Global Reader
  • Application Administrator

If these conditions are met, you are ready to configure Sync 365!

===============================================================================

===============================================================================

===============================================================================

===============================================================================

The below steps will generally not be required and are here for information or if someone specifically wants to use this method.

Alternative Method: Manual Consent in Customer Tenants

If you are unable or unwilling to assign one of the required roles (e.g., Application Administrator, Cloud Application Administrator, or Global Administrator), you can manually consent to the application in each customer tenant with the global administrator of their tenant.

Sync 365 Grant Partner Consent

1. Replace <tenantID> in the following URL with the customer tenant ID: 

   https://login.microsoftonline.com/<tenantID>/oauth2/authorize?client_id=3efeacdc-560a-41a1-b337-e302923082ea&response_mode=form_post&response_type=code&scope=https://graph.microsoft.com/directory.read.all%20%https://outlook.office365.com/exchange.manage&redirect_uri=https://sync.s365l.com&prompt=select_account

2. Access the URL using the Global Administrator account of the customer tenant.
3. Log in to grant directory read permissions, enabling advanced features such as filters, usernames, and contact synchronization.

Your own Azure AD application

To do this, simply replace the <tenantID> in the following url with the customer tenant id and <clientID> with your azure ad application client ID and access the url with the tenant global administrator: 

https://login.microsoftonline.com/<tenantID>/oauth2/authorize?client_id=<clientID>&response_mode=form_post&response_type=code&scope=https://graph.microsoft.com/directory.read.all%20%https://outlook.office365.com/exchange.manage&redirect_uri=https://sync.s365l.com&prompt=select_account

Log in with the tenant Global Administrator account to allow the directory read permissions needed for advanced functions, such as filters, usernames, and contact sync.

Azure AD Application

Sync 365 offers an option to connect by creating your own Azure AD Application in your Azure tenant. The benefit of this method is that the application resides in your tenant rather than under Sync 365 as the Control Panel Vendor.

This does mean that you will need to ensure your app secret does not expire.

With GDAP, we only require “Global Reader” and one of the following to be able to consent the app in the customer tenant:

• Global Administrator

• Privileged Role Administrator

• Cloud Application Administrator

• Application Administrator

We recommend creating a dedicated Sync 365 License user account, ensuring MFA is setup (required for partner center access), giving it access to the partner center and adding it to the relevant GDAP group for all of your customers.

We have provided an easy powershell script for you to create the application and grant consent.