Limit partner administrative access with scoped, time-bound GDAP relationships

Description

Administrative access by Microsoft partners (Cloud Solution Provider resellers, managed service providers) meets the following rules:

• no legacy delegated admin privileges (DAP): no partner holds the Partner Tier1 Support, Partner Tier2 Support or the global "admin agent" access granted by DAP;
• each granular delegated admin privileges (GDAP) relationship lists only the roles the contract requires, never Global Administrator or Privileged Role Administrator unless written in the contract for a limited period;
• each relationship lasts {{ gdap_max_duration_days }} days or less and is not set to auto-extend without review;
• relationships are reviewed at least once a year and those without an active contract are terminated.

Partner staff who administer the tenant every day get named accounts in the tenant instead (CB-M365-ADMIN-001).

Customers cannot list partner security groups or individual partner users: they see the relationship, its roles and its duration. Sign-ins of partner users appear as cross-tenant sign-ins in the sign-in logs.

Rationale

Attacks such as the Nobelium campaign compromised resellers and used their delegated access to reach customer tenants. DAP gave partners permanent Global Administrator rights over every customer. GDAP limits partner access to named roles and a fixed duration, and makes it visible to the customer, but only if the customer checks what was granted.

Impact

Partners must request the narrow roles they need, and renew relationships. Support operations that relied on DAP must move to GDAP or to named accounts.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a Global Reader.
2. Browse to Settings > Partner relationships. For each partner, check the Admin roles (GDAP or DAP), the roles granted and the end date.
3. In the Microsoft Entra admin center, browse to Entra ID > Roles & admins and open Partner Tier1 Support and Partner Tier2 Support: they must have no assignment.
4. Compare each relationship with the active contracts and the last review date.
5. Read-only PowerShell alternative (Microsoft Graph, scope Directory.Read.All): Get-MgContract -All lists the partners with a contract on the tenant.
6. Fail if a DAP relationship or a Partner Tier assignment exists, if a GDAP relationship grants Global Administrator or Privileged Role Administrator without a written, time-bound justification, if it lasts more than {{ gdap_max_duration_days }} days, or if it has no active contract.

Remediation

1. With a Global Administrator, browse to Settings > Partner relationships in the Microsoft 365 admin center.
2. For a DAP relationship: select the partner and Remove admin roles. Ask the partner for a GDAP request with the roles it needs.
3. For a GDAP relationship with excessive roles or duration: ask the partner to create a new request with the reduced scope, approve it, then terminate the old relationship (Terminate relationship in the partner panel).
4. For a partner without an active contract: terminate the relationship.
5. Remove any assignment of Partner Tier1 Support and Partner Tier2 Support in Roles & admins.
6. Record the review date and schedule the next one.

Rollback

Accept a new GDAP request from the partner.

References

• Introduction to granular delegated admin privileges (GDAP) Microsoft, vendor-doc, accessed 2026-10-24
• GDAP frequently asked questions Microsoft, vendor-doc, accessed 2026-10-24
• ANSSI, Recommandations relatives à l'administration sécurisée des SI ANSSI, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-ADMIN-012 Do not assign privileged roles to guest users

People and lifecycle