{
  "id": "CB-M365-ADMIN-017",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-017",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-017.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-017.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-017",
    "title": "Limit partner administrative access with scoped, time-bound GDAP relationships",
    "finding": {
      "title": "Partners hold broad or permanent administrative access to the tenant",
      "description": "A compromise of a reseller or managed service provider gives the attacker administrator access to the tenant through delegated permissions."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "privileged-access",
      "partners",
      "gdap",
      "third-party",
      "supply-chain"
    ],
    "parameters": [
      {
        "name": "gdap_max_duration_days",
        "type": "integer",
        "description": "Maximum duration of a GDAP relationship before it must be renewed.",
        "unit": "days",
        "default": 365,
        "minimum": 1,
        "maximum": 730
      }
    ],
    "description": "Administrative access by Microsoft partners (Cloud Solution Provider resellers, managed service\nproviders) meets the following rules:\n\n- no legacy delegated admin privileges (DAP): no partner holds the **Partner Tier1 Support**,\n  **Partner Tier2 Support** or the global \"admin agent\" access granted by DAP;\n- each granular delegated admin privileges (GDAP) relationship lists only the roles the contract\n  requires, never Global Administrator or Privileged Role Administrator unless written in the\n  contract for a limited period;\n- each relationship lasts `{{ gdap_max_duration_days }}` days or less and is not set to\n  auto-extend without review;\n- relationships are reviewed at least once a year and those without an active contract are\n  terminated.\n\nPartner staff who administer the tenant every day get named accounts in the tenant instead\n(CB-M365-ADMIN-001).\n",
    "rationale": "Attacks such as the Nobelium campaign compromised resellers and used their delegated access to\nreach customer tenants. DAP gave partners permanent Global Administrator rights over every\ncustomer. GDAP limits partner access to named roles and a fixed duration, and makes it visible\nto the customer, but only if the customer checks what was granted.\n",
    "impact": "Partners must request the narrow roles they need, and renew relationships. Support operations\nthat relied on DAP must move to GDAP or to named accounts.\n",
    "notes": "Customers cannot list partner security groups or individual partner users: they see the\nrelationship, its roles and its duration. Sign-ins of partner users appear as cross-tenant\nsign-ins in the sign-in logs.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a\n   Global Reader.\n2. Browse to **Settings** > **Partner relationships**. For each partner, check the\n   **Admin roles** (GDAP or DAP), the roles granted and the end date.\n3. In the Microsoft Entra admin center, browse to **Entra ID** > **Roles & admins** and open\n   **Partner Tier1 Support** and **Partner Tier2 Support**: they must have no assignment.\n4. Compare each relationship with the active contracts and the last review date.\n5. Read-only PowerShell alternative (Microsoft Graph, scope `Directory.Read.All`):\n   `Get-MgContract -All` lists the partners with a contract on the tenant.\n6. Fail if a DAP relationship or a Partner Tier assignment exists, if a GDAP relationship\n   grants Global Administrator or Privileged Role Administrator without a written, time-bound\n   justification, if it lasts more than `{{ gdap_max_duration_days }}` days, or if it has no\n   active contract.\n"
    },
    "remediation": {
      "manual": "1. With a Global Administrator, browse to **Settings** > **Partner relationships** in the\n   Microsoft 365 admin center.\n2. For a DAP relationship: select the partner and **Remove admin roles**. Ask the partner for\n   a GDAP request with the roles it needs.\n3. For a GDAP relationship with excessive roles or duration: ask the partner to create a new\n   request with the reduced scope, approve it, then terminate the old relationship\n   (**Terminate relationship** in the partner panel).\n4. For a partner without an active contract: terminate the relationship.\n5. Remove any assignment of **Partner Tier1 Support** and **Partner Tier2 Support** in\n   **Roles & admins**.\n6. Record the review date and schedule the next one.\n",
      "rollback": "Accept a new GDAP request from the partner.\n"
    },
    "references": [
      {
        "title": "Introduction to granular delegated admin privileges (GDAP)",
        "url": "https://learn.microsoft.com/partner-center/customers/gdap-introduction",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "GDAP frequently asked questions",
        "url": "https://learn.microsoft.com/partner-center/customers/gdap-faq",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ANSSI, Recommandations relatives à l'administration sécurisée des SI",
        "url": "https://cyber.gouv.fr/publications/recommandations-relatives-ladministration-securisee-des-si",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R59",
        "relation": "related",
        "note": "ANSSI recommends a qualified provider; this control only governs the access the provider gets."
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R60",
        "relation": "related",
        "note": "The contract terms are a prerequisite; the control checks that granted access matches them."
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R64",
        "relation": "partial",
        "note": "GDAP or named accounts give third parties dedicated access instead of shared accounts."
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R66",
        "relation": "partial",
        "note": "Time-bound relationships approximate on-demand activation; PIM for named accounts goes further."
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R69",
        "relation": "partial",
        "note": "Covers least privilege and review of partner access; traceability relies on the AUDIT domain."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SA-9",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "PS-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1199"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-ADMIN-012",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}