Which granular delegated admin role you actually need for the task in front of you. GDAP relationships should carry the minimum roles that let engineers do their jobs. This table is the "minimum" part.
The shape of GDAP in one paragraph: a relationship with each customer tenant carries a set of Entra roles and an expiry (maximum 2 years, auto-extendable). On the partner side, security groups map to those roles, so an engineer's effective access in a customer tenant works like this: they are in a partner group, the group maps to a role in the relationship, and the role applies in the customer tenant. When access unexpectedly fails, one of those three links is broken. Check group membership first, it is the usual one.
Type to filter. Matches tasks, roles and notes.
| Task | Minimum role | Notes |
|---|---|---|
| Everyday helpdesk | ||
| Reset a standard user's password | Password Administrator | Helpdesk Administrator also works and adds sign-in log read. Neither can touch admins' passwords. |
| Reset MFA / re-register authentication methods | Authentication Administrator | Also issues Temporary Access Passes. For users holding admin roles you need Privileged Authentication Administrator. |
| Revoke sessions / block sign-in on a standard user | Helpdesk Administrator | User Administrator for anything beyond enable/disable and password. |
| Create users, edit profiles, manage licences | User Administrator | Licence-only work fits the narrower License Administrator. |
| Manage groups and memberships | Groups Administrator | User Administrator covers most group membership too; Groups Administrator is the precise fit. |
| Invite and manage guest users | Guest Inviter | Just inviting. Managing guests after redemption is User Administrator territory. |
| Read-only and reporting | ||
| Read everything, change nothing (tenant assessments) | Global Reader | Belongs in every GDAP relationship. Covers config review across all workloads without write risk. |
| Read sign-in and audit logs | Reports Reader | Security Reader also reads them and adds security-portal read. Global Reader covers both. |
| Usage reports (mailbox sizes, Teams activity) | Reports Reader | Enough for Get-MgReport* cmdlets. |
| Exchange Online | ||
| Mailbox admin: permissions, forwarding, shared mailboxes, quotas | Exchange Administrator | Covers the whole Exchange builder. Exchange Recipient Administrator is the narrower recipient-only alternative. |
| Message trace | Exchange Administrator | Global Reader can read traces too, which is enough for missing-email triage without write access. |
| Release quarantined messages | Security Administrator | Quarantine lives in Defender, not Exchange. Quarantine Administrator (Defender RBAC) is the precise fit where configured. |
| Transport rules, connectors, accepted domains | Exchange Administrator | Connector changes affect all mail flow, so treat it as change-controlled work. |
| Identity security | ||
| Read Conditional Access policies | Security Reader | Global Reader also works. |
| Create and edit Conditional Access policies | Conditional Access Administrator | Pairs naturally with the CA policy explainer and baseline guide. |
| Investigate risky users, dismiss risk | Security Operator | Reading alone is Security Reader; dismissing risk needs Operator or Security Administrator. |
| Incident response: contain a compromised account | Security Administrator + User Administrator | Session revocation and sign-in block are user-write actions; risk and restricted-sender handling are security actions. The incident builder runbooks assume both. |
| Manage admin role assignments in the customer tenant | Privileged Role Administrator | Extremely powerful: it grants the ability to grant. Most MSPs should not hold this standing; request it per-incident. |
| Devices and Intune | ||
| All Intune work: policies, apps, remote actions, enrolment | Intune Administrator | Covers the whole Intune builder including wipe. No narrower built-in role covers remote actions. |
| Read device compliance for triage | Global Reader | Enough for the device-state checks in the sign-in guide. |
| Entra device objects: enable/disable/delete, BitLocker keys | Cloud Device Administrator | BitLocker recovery key read is the common reason this role gets requested. |
| Collaboration workloads | ||
| SharePoint and OneDrive admin: sites, sharing, storage | SharePoint Administrator | Covers the SharePoint builder and the leaver OneDrive handover. |
| Teams admin: policies, voice, meetings | Teams Administrator | Teams Communications Administrator is the voice/telephony-only subset. |
| Compliance and audit | ||
| Search the unified audit log | Compliance Administrator | The audit-log searches in the Purview builder. Global Reader can read some but not run compliance searches. |
| Compliance search and purge (phishing cleanup) | Compliance Administrator + Search And Purge | The purge step in the phishing runbook needs the Search And Purge Purview role on top, assigned in Purview RBAC, not Entra. |
| Litigation holds, retention policies | Compliance Administrator | See the retention guide for how the pieces interact. |
From the partner tenant, Graph exposes the relationships and their role assignments, worth a quarterly review against this table:
Connect-MgGraph -Scopes "DelegatedAdminRelationship.Read.All" -NoWelcome
Get-MgTenantRelationshipDelegatedAdminRelationship |
Select-Object DisplayName, Status, @{n='Customer';e={$_.Customer.DisplayName}},
@{n='Roles';e={$_.AccessDetails.UnifiedRoles.RoleDefinitionId.Count}}, EndDateTime
Role definition IDs map to names via Get-MgRoleManagementDirectoryRoleDefinition. Relationships nearing EndDateTime without auto-extend are the ones that cause the "we suddenly can't manage the customer" morning.
Three recurring ones. Protected admins: Authentication Administrator and Helpdesk Administrator cannot act on accounts holding higher roles. Resetting a customer Global Admin's MFA needs Privileged Authentication Administrator, and the error will misleadingly look like a permissions bug. Portal vs role mismatch: some blades (Defender quarantine, Purview) use their own RBAC on top of Entra roles; the Entra role gets you in the door, the workload role governs the button. The missing group link: GDAP roles bind to partner security groups, so a new engineer with "the same role as everyone else" but no access is almost always missing the group membership, not the role.