Access Denied – Caller Lacks Valid Entra Role

Error: Access Denied – Caller should have a valid Entra role

This error means the account making the request is not assigned any valid role in Microsoft Entra ID (formerly Azure AD) within the customer tenant — often due to GDAP misconfiguration.

Cause: The Sync 365 delegated admin account is not assigned via a GDAP relationship with sufficient permissions.

Resolution

Fix the GDAP relationship as follows:

1. Log in to Microsoft Partner Center
2. Navigate to the affected customer’s GDAP configuration
3. Verify:
   • The correct security group is assigned to the GDAP roles
   • Your Sync 365 admin account is a member of this group
   • The group includes at least the following roles:
     • Application Administrator
     • Global Reader

Full step-by-step guide: Checking your GDAP relationship

Changes usually take effect within ~30 minutes after group updates.