Step 1: Request the GDAP relationship in Partner Center

Create the GDAP request for a client with the six roles Lemhi needs, a 730-day duration, and auto extend on.

Written By The Lemhi Product Team

Last updated 10 days ago

This is for the MSP admin requesting a new GDAP relationship with a client. When you finish, the client has an approval link waiting for their Global Administrator.

Before you start

Complete Before you connect a client.

Open the request form

In the left menu select Admin relationships, then Request for new relationship.

Admin relationships page with Request for new relationship

Set each field to the value in the first table below.

Field values

Field	Set to
Admin relationship name	Unique, 50 characters or fewer, recognizable to the client (for example "Your MSP Name - Lemhi"). The client sees this name in their admin center.
Duration in days	730 (the maximum)
Auto extend	Yes (renews six months at a time instead of expiring)
Requested Microsoft Entra roles	Select Select Microsoft Entra roles, check the six roles below, then Save

Roles to select

Role	Set to	Why Lemhi needs it
Cloud Application Administrator	Selected	Required. Lets Microsoft grant Lemhi's application consent into the client tenant. Without it, the connection fails.
Global Reader	Selected	Directory, licensing, and Microsoft 365 configuration. This is the core of the assessment.
Reports Reader	Selected	Per-site and per-user usage reports for the Data Governance views. Microsoft's suggested role sets leave it out, so add it by hand.
Security Reader	Selected	Defender alerts, incidents, vulnerabilities, and Secure Score.
Compliance Administrator	Selected	Purview settings: DLP, retention, and sensitivity label policy definitions.
Power Platform Administrator	Selected	Copilot Studio and Power Platform agent inventory, and Managed Agents.
Global Administrator	Not selected	Lemhi doesn't need it, clients push back on it, and Microsoft won't auto-extend a relationship that includes it.

The roles are grouped by category in the picker: Global reader, Reports reader, and Security reader are under Read Only; Compliance administrator is under Security & Compliance; Cloud application administrator is under Identity; Power platform administrator is near the top of the list, above Global.

Role picker with Reports reader and Compliance administrator selected

When you're done, the form should look like this:

Completed request form with six roles and Auto Extend set to Yes

Finalize the request

Select Finalize request, then Done.
Partner Center shows an email with a personalized approval link. Send it to the client's Global Administrator. You can change the wording; don't change the link.

Before you finalize, two things to know:

Request all six roles now. Roles can't be added later. Leaving one out means another new relationship and another approval ask to your client.

The request expires after 90 days if the client doesn't act on it.

Step 2: Your client approves the request

Was this helpful?

Still need help? Ask the team