What is GDAP (granular delegated admin privileges)?
Checked October 27, 2026 by Accred Consulting
GDAP (granular delegated admin privileges) is how a Microsoft Cloud Solution Provider partner gets admin access to a customer’s tenant. The customer explicitly grants specific Microsoft Entra roles for a fixed period, at most two years, instead of standing global access. GDAP replaced DAP, which Microsoft retired because its long-lived, highly privileged access was open to attack.
How a GDAP relationship works
- The partner requests an admin relationship that lists the Microsoft Entra roles it needs and a duration.
- A customer administrator approves the request. The customer must explicitly grant the access.
- The partner assigns the granted roles to security groups in its own tenant, so only the technicians in those groups get them.
- The relationship ends when its duration runs out unless it is extended. Auto-extend adds six months at a time.
A relationship can last from 1 to 730 days. Permanent GDAP relationships are not possible.
GDAP compared with DAP
| DAP (retired) | GDAP | |
|---|---|---|
| Roles granted | Broad, highly privileged access | Only the Microsoft Entra roles the customer approves |
| Duration | Long-lived | 1 to 730 days, never permanent |
| Who on the partner side gets access | Partner admin agents broadly | Members of the security groups the partner assigns |
| New customers | Not granted since September 25, 2023 | Default GDAP with specific roles |
What an MSP should track for each customer
- Relationships that expire soon, so access does not lapse in the middle of work.
- Roles you still need but were not granted, and roles you hold but no longer use.
- Which security groups, and so which technicians, hold each role.
- Customers still on DAP, which GDAP is replacing.
Microsoft 365 Lighthouse needs a GDAP or DAP relationship to onboard a customer. Accred Fleet, in development, is being built to show each customer’s GDAP status, including relationships that are expiring or missing roles it needs; its current build uses sample data.
Questions
How long can a GDAP relationship last?
Up to two years: a relationship is set from 1 to 730 days. Permanent GDAP relationships are not possible, and auto-extend adds six months at a time.
Why did Microsoft retire DAP?
Microsoft says DAP is susceptible to security attacks because of its longevity and high privileged access. Since September 25, 2023, new customers get default GDAP with specific roles instead of DAP.
Does a customer have to approve GDAP?
Yes. Customers must explicitly grant least-privileged access to their partners through the admin relationship request.
Do I need GDAP for Microsoft 365 Lighthouse?
Lighthouse needs either a GDAP or a DAP relationship to onboard a customer tenant.
Sources
- Introduction to granular delegated admin privileges (GDAP) · Microsoft Learn
- GDAP frequently asked questions · Microsoft Learn
- GDAP migration FAQ · Microsoft Learn
- Requirements for Microsoft 365 Lighthouse · Microsoft Learn
Create your organization, then turn on the apps you need.
Hub, Manage, and the Connect preview are free for your whole team, and Assess is free to start.