Forum Discussion
GDAP: Roles required for conditional access?
Hi
I've been evaluating the minimal roles required for GDAP relationships so we can help customers with issues regarding to locked tenants.
Based on this FAQ the role privileged authentication administrator is required to unlock accounts, however if a customer has messed up conditional access at the tenant level, this role isn't sufficient. A tenant-internal account needs at least the role conditional access administrator to gain access to that part and have the possibility of fixing or disabling erroneously configured rules (I've tested that). However the same privileges are given to a partner technician, they can't access that part of Entra Admin, nor the AAD Admin UI.
I've tested this a couple of times with different users from the CSP / partner side, however no luck yet. Any Ideas where I could poke further?
(I'd like to avoid simply requesting global admin to all our customers, that's the main point)
Looking forward to some inputs or ideas
LicensingConcierge1Microsoft
Hi ise-ms
Thank you for posting on the CSP community.
I'm not sure what the question is, therefore, would you mind clarifying please?
Regards,
Microsoft CSP Licensing Concierge
I hope this helps: granular delegated admin privilege or GDAP has been introduced as a replacement for the broader DAP partner relationships between (at least) Microsoft CSPs and their customers.
The idea of granular privileges is (as I understood id) to follow principles of least privilege. I've been able to identify the roles required for a user account within a customer-tenant to obtain just enough privileges to access and modify conditional access rules.
However if I grant just the same roles to a technician that is allowed to access a customer tenant via GDAP relationship, they are unable to even see the conditional access rules.
If I grant a technician wider permissions (global admin), they can access that part, so it's not that delegated CSP technicians are completely unable to see and modify conditional access rules - however with roles assigned that grant them much more access.
See also the built-in Azure AD / Entra ID roles here: Azure AD built-in roles - Microsoft Entra | Microsoft Learn.
- We too are experiencing the same. We have allocated Security Admin role to technicians via GDAP and they are unable to modify conditional access policies.
