Admin Relationships

Azure GDAP > Admin Relationships manages the delegated admin relationships that give your partner tenant administrative access to this organization’s Microsoft tenant. It covers the whole lifecycle — request, customer approval, role assignment, compliance checking and termination — rather than only showing which relationships exist.

What GDAP is, and why the relationship has a lifecycle

Granular Delegated Admin Privileges replaced the older DAP model, in which a partner held Global Administrator on every customer tenant by default. GDAP grants specific roles, to a specific security group, for a bounded period, and the customer must approve it.

That approval step is why relationships move through states instead of simply existing. Creating one in MSPControl does not grant access — it creates a request that somebody at the customer has to accept.

Statuses and what each one allows

The status drives which row actions are available. Only the actions valid for that state are clickable; the rest are greyed out.

Status	Meaning	Actions available
Created	The relationship exists locally; no request has been sent	Make request, Delete
ApprovalPending	The request is with the customer, awaiting acceptance	Send reminder email, Copy invitation link, Terminate
Active	Approved and in force	Create/update access assignments, Terminate
Activating, Approved	Transitional, on the way to Active	—
Expiring, Expired	Reaching or past the end date	—
TerminationRequested, Terminating, Terminated	Being withdrawn, or already withdrawn	—

Delete and Terminate are different things

Delete removes a relationship that was never requested — it is only offered in Created. Terminate withdraws access that exists, and the terminated record stays in the list as history.

Once a relationship has been requested, delete is no longer an option: there is now something at Microsoft’s end to withdraw.

Creating a relationship

1. Click Create Admin Relationship.

2. Choose a Policy. The policy — defined under Settings > Policies > Azure GDAP Policy — supplies the partner name, the duration (up to 730 days), the tenant-level roles requested, and the per-security-group role assignments.

3. Confirm. The relationship is created in Created state; nothing has been sent to the customer yet.

4. Use Make Admin Relationship request on the row. This sends the approval invitation email to the customer and moves the relationship to ApprovalPending.

5. When the customer accepts, the relationship becomes Active.

Pick the narrowest policy that does the job

The policy chosen at creation determines what you will hold in that tenant for up to two years. A read-only policy is the right default for monitoring and reporting work; reserve broader policies for organizations where technicians genuinely administer the tenant.

Narrowing it later means creating a new relationship and getting it approved again — the customer is involved either way, so the cheap moment to get it right is now.

Chasing an approval

Two actions exist because customers rarely act on the first email:

• Send Customer Approval invitation reminder Email re-sends the invitation.
• Copy Approval invitation link to Clipboard copies the Microsoft admin-portal link so you can send it through a ticket, chat, or a phone call with someone who is looking at the screen.

Neither creates a second relationship. Use them instead of re-requesting, or the customer ends up with duplicate pending invitations and approves an arbitrary one.

Compliance and access assignments

Compliance Status does not mean “valid” — it means matches the GDAP policy. MSPControl compares the relationship’s granted roles against the policy it was created from and shows Policy Compliant or Policy Non-Compliant.

A separate icon appears on Active rows whose security-group access assignments do not match the policy: Create/update Access Assignments according Policy. Running it pushes the policy’s group-to-role assignments to the relationship.

An approved relationship can still grant nobody anything

The relationship grants roles to security groups. If the access assignments were never created, the relationship is Active and compliant-looking while no technician actually holds the roles — access requests fail for reasons that have nothing to do with the relationship’s status.

The assignment icon only shows when there is a mismatch, so treat its appearance as work to do rather than decoration. Allow a short delay after running it before the list reflects the change.

Filters

Filter	Effect
Only Active	Current access only
Only Created in Control Panel	Relationships MSPControl created, hiding any made directly in Partner Center
Only Policy Not-Compliant	The governance exceptions

Only Created in Control Panel is ON by default

The list opens filtered to relationships MSPControl created. A relationship set up directly in Partner Center — including anything predating your use of MSPControl — is not shown until you clear this checkbox.

If a customer insists a relationship exists and the list disagrees, clear it before concluding anything is missing.

Details

Clicking the relationship name opens a panel with the status, start and end dates, the unified roles granted at tenant level, and each security group with its own assigned roles. This is the view to use during an access audit — the list shows whether a relationship exists, the panel shows what it actually grants.

The fleet-wide view

Settings > Azure GDAP > Admin Relationships shows the same data across every customer, with a Customer column added. It is the review screen: it can terminate a relationship, but not create, request, or repair one — those stay on the organization’s own page.

Review expiry across the estate, not per customer

A GDAP relationship ends on its end date whether or not anyone noticed, and technicians discover it as a sudden loss of access. Checking the fleet-wide list for approaching end dates is the only way to see that coming; the per-organization page shows you one customer at a time.

The GDAP Admin Relationships Checking scheduled task automates the same check — see scheduled tasks.

Related

• Azure GDAP Policy — what a policy defines
• Azure settings
• Hosted organizations