What Is GDAP? Roles, Expiry and Its Limits

For MSP and MSSP technicians and owners who administer client Microsoft 365 tenants through Partner Center: what GDAP is, which roles to grant, the limits that catch people out, and what GDAP doesn't cover.

GDAP (granular delegated admin privileges) is the Partner Center relationship that gives a partner's technicians time-bound, role-scoped admin access to a customer's Microsoft tenant. It replaces DAP (delegated admin privileges), which gave partners standing Global Administrator access. You pick the Microsoft Entra roles, assign them to security groups in your own partner tenant, the customer approves, and the relationship ends unless it's extended.

How this page was made: every Microsoft rule below is quoted from Microsoft Learn or Microsoft's security blog, checked on 22 October 2026 and linked at the end. CyberQP makes Panthera, a privileged access management platform; where it fits is in one section near the end.

Why GDAP replaced DAP

DAP gave partners Global Administrator in every customer tenant, with no end date. In October 2021 Microsoft reported that the actor it called NOBELIUM (now Midnight Blizzard) was targeting cloud service providers, MSPs and other IT services organizations to reach their downstream customers, and noted that "these delegated administrative privileges are often neither audited for approved use nor disabled". One example chain it described ran through "four distinct providers" (Microsoft Security, 25 October 2021).

GDAP is Microsoft's answer: least-privileged, "granular and time-bound access" that "customers must explicitly grant". Microsoft's FAQ says GDAP is replacing DAP; during the transition they coexist, with GDAP permissions taking precedence for Microsoft 365, Dynamics 365 and Azure workloads, and Microsoft recommends moving customers to GDAP "as soon as possible".

How a GDAP relationship works

A GDAP relationship is per customer, and you can have more than one with the same customer. Each one has its own roles, its own duration and its own security groups.

1. Request: in Partner Center, create a relationship request for the customer with the Microsoft Entra roles you need and a duration. Requests the customer doesn't act on expire after 90 days.
2. Customer approval: the customer approves the request. Microsoft: "Customers must explicitly grant the least-privileged access to their partners." Nothing is granted until they do.
3. Security groups: in your partner tenant, assign each approved role to a security group, then put technicians in the groups. Access follows group membership, so a technician who leaves loses access when you remove them from the group.
4. Expiry: the relationship ends on its end date unless auto extend is on.

Which roles to grant each technician tier

Grant each group only the roles its work needs, and keep Global Administrator out of the everyday relationship. Microsoft's GDAP role guidance lists roles for a tier-1 technician in managed services and a least-privileged role for common tasks.

Tier 1 (help desk), from Microsoft's tier-1 list:

• Helpdesk Administrator: reset passwords for non-administrators and a short list of low-privilege admins.
• Authentication Administrator: view, set and reset authentication methods (MFA) for non-admin users.
• User Administrator and Groups Administrator: manage users and groups, including blocking a departing employee's sign-in.
• License Administrator: assign and remove licenses.
• Service Support Administrator: open support requests with Microsoft for the customer.
• Exchange Administrator, SharePoint Administrator, Intune Administrator and Teams Communications Support Specialist: the workload each one names.
• Security Reader, Directory Readers and Message Center Reader: read-only troubleshooting.

Above tier 1, by task: Microsoft's task table names the role for each job rather than a tier. Resetting a privileged admin's password needs Privileged Authentication Administrator. Adding a user to a directory role needs Privileged Role Administrator. Updating a privileged admin's user principal name or certain user settings needs Global Administrator. Those three are the roles to put in a separate relationship, give to fewer people and make just-in-time.

GDAP limits that catch MSPs out

Four rules from Microsoft's GDAP FAQ and GDAP introduction decide how you structure relationships:

• Two years at most. "The maximum duration of a GDAP relationship is two years." Permanent relationships aren't possible.
• Auto extend adds six months, but not with Global Administrator. With auto extend on, a relationship extends by six months at its end date until it's terminated. Asked whether a relationship with Global Administrator can auto extend, Microsoft's answer is "No."
• 100 security groups per customer. "Partners will encounter a limit of 100 security groups available per customer."
• Expiry stops access, not billing. When a relationship expires you request a new one, and "there's no change to a customer's existing subscriptions".

The practical consequence: split each customer into at least two relationships. One holds the everyday roles with auto extend on. The other holds Global Administrator, has an end date, and gets re-requested on purpose when it's needed. Bundle Global Administrator into the everyday relationship and that whole relationship can't auto extend, so every role in it lapses together on the end date.

Making GDAP access just-in-time

GDAP limits which roles a group holds; it doesn't limit when a technician holds them. Microsoft's FAQ says partners can put Privileged Identity Management on a GDAP security group in the partner tenant, so a few people are elevated into high-privilege roles "just in time (JIT)" with automatic removal. How to set that up with PIM for Groups, and where Entra PIM stops, is covered in IAM vs PAM vs PIM, and where Entra PIM stops.

What GDAP doesn't reach

GDAP governs your technicians' delegated access to the customer's Microsoft cloud tenant. It doesn't touch the privileged accounts that live inside each client:

• Local administrator accounts on workstations and servers. See removing local admin rights across every client and Windows LAPS vs a PAM platform.
• On-premises Active Directory admins and service accounts. GDAP is a cloud relationship; a hybrid client's domain admins sit outside it.
• The customer's own Global Administrators and break-glass accounts. These are accounts in the customer's tenant, not your delegated access. See break-glass accounts: Microsoft's rules per tenant.
• Other identity platforms. A client on Google Workspace has no GDAP equivalent.
• Shared credentials. Passwords technicians still keep for client systems, appliances and line-of-business apps.

A partner can move every customer to GDAP, with tight roles and PIM on the high-privilege groups, and still have standing privilege in every one of those places. The eight phases that cover all of it, from discovery to endpoint privilege, are in zero standing privilege: the PAM journey for MSPs.

Where Panthera fits

GDAP is how a partner reaches into a client's Microsoft tenant. Panthera connects to each client separately to manage the privileged identities GDAP leaves alone:

• Connecting to each client: Panthera connects to a client's Entra tenant through a direct enterprise app. Connecting through the partner's GDAP or Cloud Solution Provider (CSP) relationship is coming to Panthera. Each client is connected separately, so one compromised connection doesn't expose every other client.
• Finding privileged identities: Panthera continuously finds privileged identities in each client, from admin accounts to service accounts and break-glass accounts.
• Storing and rotating credentials: credentials go in a zero-knowledge vault that restricts each one to authorized technicians and logs who accessed it, and rotate on demand or on a schedule.
• Just-in-time accounts: technicians work through dedicated accounts that are disabled by default and enabled for a task, with an optional second approval. Technicians sign in to Panthera with MFA, a passkey or SSO before they can use them.

Frequently asked questions

What does GDAP stand for?

Granular delegated admin privileges. It's the Microsoft Partner Center model that gives partners role-scoped, time-bound admin access to customer tenants, approved by the customer.

How long does a GDAP relationship last?

Up to two years. With auto extend on, it extends by six months at its end date until terminated, except relationships that include Global Administrator, which can't auto extend.

Can a GDAP relationship include Global Administrator?

Yes, but it can't auto extend. Microsoft's role guidance names Global Administrator for only a few tasks, so keep it in a separate relationship from everyday roles.

Is DAP still supported?

During the transition DAP and GDAP coexist, with GDAP taking precedence for Microsoft 365, Dynamics 365 and Azure. Microsoft says GDAP is replacing DAP and recommends moving customers "as soon as possible".

Does GDAP work with Privileged Identity Management?

Yes. Partners can apply PIM to a GDAP security group in their own partner tenant, so technicians are elevated into high-privilege roles just in time and lose them automatically.

Sources (checked 22 October 2026): Microsoft Learn, GDAP introduction (updated 28 April 2026); Microsoft Learn, GDAP frequently asked questions (updated 20 April 2026); Microsoft Learn, GDAP role guidance (updated 25 November 2024); Microsoft Security, NOBELIUM targeting delegated administrative privileges (25 October 2021).

Related: IAM vs PAM vs PIM, break-glass accounts, just-in-time admin access for MSP technicians, Panthera free trial, book a demo.