Skip to main content
Connecting Microsoft 365 (GDAP)

How Lemhi connects to your clients' Microsoft 365 tenants

Lemhi reads each client tenant through your GDAP relationship. Here is how the connection works, what it can touch, and how to revoke it.

Written By The Lemhi Product Team

Last updated 10 days ago

Lemhi reads each client's Microsoft 365 tenant through your GDAP relationship with that client. For the connection to work, the relationship needs the right roles, and those roles need to reach the account you use for Lemhi. The only thing your client does is one approval click.

How the connection works

  • Lemhi rides on your existing Microsoft partner relationship. It never holds a password to a client tenant, and the client never grants Lemhi an admin role directly.

  • Every call is delegated. Lemhi acts on behalf of the specific MSP administrator who completed Partner Connect, and Microsoft checks that person's GDAP access on every call. Lemhi has no standing application-only permission that would let it reach a tenant on its own.

  • You control the scope. Lemhi can only reach clients you hold an active GDAP relationship with, and only after an MSP administrator explicitly imports that client in Lemhi.

  • Lemhi is a verified Microsoft publisher. The consent screen names Lemhi as the verified publisher, so the approver can confirm who they're authorizing.

What your client does

Your client's Global Administrator approves your GDAP request once. Nothing else is asked of them.

What Lemhi can and can't access

Every assessment Lemhi runs is read-only. Lemhi reads configuration, posture, and aggregate usage data. It never reads the contents of email, files, Teams chats, or calendars.

Lemhi writes into a client tenant only when your administrator takes the action: creating a Copilot agent through Managed Agents, or applying a setting through Client Configuration if that feature is on for your organization.

Access is auditable in the client's Microsoft 365 audit logs and can be revoked at any time: the client can end the partner relationship in their admin center, or you can disconnect the client in Lemhi. The full permission list is in Permissions Lemhi's application receives.

Next

Which GDAP situation are you in?

Was this helpful?

Still need help? Ask the team