GDAP roles Lemhi needs and why

The six GDAP roles Lemhi asks for, why three are administrator roles, the roles it never asks for, and the Partner Center requirements.

Written By The Lemhi Product Team

Last updated 10 days ago

These roles belong to your GDAP relationship with each client. Lemhi never receives them as roles of its own. They set what Lemhi's delegated calls are allowed to see.

Roles on the relationship

Role	Required?	What it enables in Lemhi
Cloud Application Administrator	Required	The one role Microsoft demands before it will grant Lemhi's application consent into the client tenant. Application Administrator also works. Privileged Role Administrator no longer does; Microsoft retired it for this purpose.
Global Reader	Recommended	Directory, licensing, Conditional Access, and Microsoft 365 configuration. The core of the assessment.
Reports Reader	Recommended	Per-site and per-user usage reports for the Data Governance views. Without it, Lemhi only sees tenant-level totals.
Security Reader	Recommended	Defender alerts, incidents, vulnerabilities, and Secure Score.
Compliance Administrator	Recommended	Purview policy definitions: DLP, retention, and sensitivity labels.
Power Platform Administrator	Recommended	Copilot Studio and Power Platform agent inventory, and Managed Agents.

A missing recommended role narrows the assessment. A missing Cloud Application Administrator blocks the connection. Because Microsoft locks a relationship's roles when it's created, request all six up front.

Why three of these are administrator roles

Cloud Application Administrator is the role Microsoft requires for consent; there's no reader equivalent. Compliance Administrator is the role Microsoft honors for reading Purview policy definitions over delegated access. Power Platform Administrator is needed to see the agent inventory and to publish Managed Agents. Lemhi uses them for those purposes only. Each role sits on your relationship and reaches only the people in the security group you assign.

Roles Lemhi does not ask for

Global Administrator, Exchange Administrator, SharePoint Administrator, User Administrator, or any role that manages users, passwords, or licenses. Leaving Global Administrator out also keeps the relationship eligible for Microsoft's auto-extend.

If your relationship only carries billing roles

A relationship with only billing roles (for example, Billing Administrator) can't support Lemhi as is, and it can't be edited to add roles. The fix is a second relationship with the six roles above. Your billing relationship stays exactly as it is. The steps start at Step 1.

Partner Center requirements for the connecting account

Requirement	Why
Admin agent in your Partner Center	Partner Center's gate for any partner API call. Without it every client connection fails.
Direct member of the security group assigned the roles above on each client's relationship	Microsoft evaluates the individual's group membership at call time. The role has to reach that person, not just exist somewhere in your tenant.
A reseller (CSP) relationship	Not required. Clients who buy Microsoft licenses directly are fully supported.

Was this helpful?

Still need help? Ask the team

Roles on the relationship

Why three of these are administrator roles

Roles Lemhi does not ask for

If your relationship only carries billing roles

Partner Center requirements for the connecting account

Related