GDAP (Granular Delegated Admin Privileges)

Definition

GDAP is Microsoft's current model for partner access to customer Microsoft 365 and Entra ID tenants, replacing the legacy Delegated Admin Privileges (DAP) that Microsoft force-retired in 2023. Where DAP gave a partner standing, Global Admin-equivalent access to every customer tenant indefinitely, a GDAP relationship is per-customer, scoped to specific Entra admin roles, and time-boxed to 1–730 days, expiring unless renewed. Roles are assigned to security groups in the partner tenant, so only the technicians who need a given role in a given tenant actually hold it – least privilege instead of every tech holding keys to every client.

Why it matters to an MSP

MSPs are supply-chain targets: one compromised partner tenant with standing admin over dozens of client tenants is the Microsoft-cloud equivalent of the 2021 Kaseya VSA attack, and the CISA AA22-131A advisory exists because attackers know it. GDAP is your blast-radius control – a stolen technician token yields limited roles in specific tenants for a limited window, not Global Admin everywhere. It's also table stakes commercially: transacting through the CSP program requires GDAP, and cyber-insurance questionnaires and security-literate clients increasingly ask how partner access is scoped. Adopt the standard pattern: least-privilege role sets per customer, security-group assignment, phishing-resistant MFA on every partner account, and just-in-time elevation via Entra PIM for the few genuinely privileged roles instead of standing assignments.

Related terms: MFA, PAM, Zero Trust