Azure Granular Delegated Admin Privileges Setup

Beta

Granular Delegated Admin Privileges setup is currently in beta. The setup option is available in the Spotto portal, but Microsoft access validation, subscription discovery, and scan enablement still depend on the partner and customer access being ready.

Use this setup guidance when an MSP or CSP partner is preparing to connect customer Azure environments through Microsoft Partner Center instead of creating a separate Spotto service principal in every customer tenant.

With this model:

• The partner creates and maintains the GDAP relationship in Microsoft Partner Center.
• The customer approves the requested delegated roles in Microsoft 365 admin center.
• The partner assigns the approved roles to a partner security group.
• Spotto stores a partner authorization profile in the partner root company.
• Each customer company stores its own GDAP cloud account, scan history, subscriptions, and findings.

How Azure Access Actually Works

Read this section before you request a GDAP relationship. Most failed GDAP onboardings come from assuming these three things are one thing. They are three separate grants, configured in three different places, and getting one right does nothing for the other two.

Layer	What it grants	Where you configure it	What you see in Spotto when it is missing
A. Delegated Entra roles	Delegated sign-in and read access inside the customer's Microsoft Entra directory	Partner Center: the roles requested on the relationship, assigned to your partner security group	GDAP relationship, Access assignment, or Application consent is Blocked
B. Azure subscription access	The ability to see and read the customer's Azure subscriptions, resources, and metrics	Security group nesting under Admin Agents for CSP/Azure Plan, or Azure RBAC assigned by the customer for EA and MCA-direct	Subscription discovery is Blocked, or validation returns No readable subscriptions
C. CSP billing visibility	Cost and usage amounts for subscriptions you bill under CSP	Partner-side billing account policy in your own partner tenant	The account connects, but Cost read or Partner Billing Cost Read is Degraded and cost data is empty or partial

The most common first-run failure

Entra roles on a GDAP relationship grant zero Azure permissions. A relationship can be active, correctly approved, and correctly assigned, and Spotto will still find no subscriptions, because that is Layer B. No Entra role fixes it. Complete Layer B before your first validation.

When To Use GDAP

Use GDAP when all of these are true:

• You are an MSP or CSP partner managing Azure customers through Partner Center.
• The customer has approved a GDAP relationship with your partner tenant.
• Your partner security group has the Microsoft Entra roles needed for the customer workloads you want Spotto to analyze.
• Azure subscription access is available through the customer's CSP/Azure Plan relationship or through Azure RBAC that the customer has assigned.
• The customer tenant has granted the required Spotto application consent for the GDAP flow.

Use Automatic Azure Connect, PowerShell Script, Terraform Module, or Manual Azure Portal Setup instead when the customer wants a dedicated service principal in their own tenant or when there is no Partner Center GDAP relationship.

important

GDAP is not a shortcut around customer approval. The customer remains in control of the relationship, delegated roles, and any Azure RBAC assignments required for their subscriptions.

Who Does What

Person	Responsibility
Partner admin	Creates the GDAP relationship request in Partner Center, chooses the duration and roles, sends the approval link to the customer, and assigns approved roles to a partner security group.
Partner admin agent	Nests the assigned security group under Admin Agents so CSP/Azure Plan subscriptions become readable (Layer B).
Partner admin agent with billing admin	Turns on Azure Usage visibility for the customer in the partner billing account (Layer C).
Customer global admin	Reviews and approves the GDAP relationship request in Microsoft 365 admin center, and grants the Spotto application consent in the customer tenant unless the partner does it through the relationship.
Azure subscription owner or user access admin	Confirms any required Azure RBAC access for the customer's subscriptions (Layer B for EA and MCA-direct).
Spotto admin in the partner root company	Authorizes the partner profile with Microsoft and creates one GDAP cloud account per customer company.

Before You Start

Decide these two things before you request the relationship, because neither can be changed afterwards without starting a new relationship:

• The full set of Entra roles. See Choose The Entra Roles. Roles cannot be added to a relationship after the customer approves it.
• Who will grant the customer tenant application consent. If you will grant it yourself, Cloud Application Administrator must be in the original role request. If the customer's own Global Administrator will grant it, it does not. See Partner Access And Consent.

Copy IDs, Not Display Names

Microsoft shows friendly names beside most GDAP objects. Spotto needs the identifiers, not those names.

Spotto field	Correct value	Example	Common wrong value
Customer Tenant ID	Microsoft Entra tenant GUID	4fdbff88-9d6b-42e0-9713-45c922ba8001	Customer name or verified domain
GDAP Relationship ID - not the relationship name	The relationship's id value	5d027261-d21f-4aa9-b7db-7fa1f56fb163-8777b240-c6f0-4469-9e98-a3205431b836	A display name such as Contoso_GDAP_2026
Security Group Object ID - not the group name	The partner group's Microsoft Entra Object ID GUID	869713c9-0b28-4d08-8949-ae07ae1bf528	A display name such as CPM Admins

The tenant and security-group Object IDs are 36-character GUIDs. Microsoft Graph defines the relationship ID as a string rather than a fixed GUID schema; Microsoft's current examples use two GUIDs joined by a hyphen. Copy it exactly instead of typing it from the relationship name.

To find the relationship ID reliably:

1. Sign in to Microsoft Graph PowerShell using the partner tenant.
2. Run Connect-MgGraph -Scopes DelegatedAdminRelationship.Read.All.
3. Run Get-MgTenantRelationshipDelegatedAdminRelationship | Select-Object Id, DisplayName, Status.
4. Match the approved relationship by DisplayName and customer, then copy its Id value.

You can also call GET /tenantRelationships/delegatedAdminRelationships in Microsoft Graph and copy the matching object's id. Microsoft documents the same ID in its Get delegatedAdminRelationship example.

To find the security-group Object ID:

1. Open the Microsoft Entra admin center in the partner tenant.
2. Open Entra ID -> Groups -> All groups.
3. Select the security group assigned to the GDAP relationship.
4. Open Properties and copy Object ID. Do not copy Group name.

Microsoft's group management guide confirms that Object ID is the immutable identifier to copy.

Collect these values before opening Spotto:

• Partner tenant ID.
• Customer tenant ID.
• GDAP relationship ID from Partner Center.
• Partner security group ID for the group assigned to the relationship.
• Confirmation that the relationship is active and has access assignments.
• Confirmation that the customer subscriptions Spotto should scan are visible through the delegated access path.

If the customer uses CSP billing, also review CSP Billing Prerequisites. Billing visibility can depend on partner-side Azure Usage visibility in addition to delegated access.

Confirm You Can Test GDAP

Partner IDs, an associated partner ID, or Microsoft AI Cloud Partner Program membership do not by themselves mean you can create GDAP relationships. Confirm that the partner tenant can manage customers in Partner Center before using this Spotto setup path.

Check these items in Microsoft Partner Center:

1. Sign in using the partner tenant that owns the customer relationship.
2. Confirm the account has an active customer-management program, such as CSP, reseller, or advisor capability.
3. Confirm your user has the partner role needed to manage customer admin relationships, such as Admin agent.
4. Open Customers and confirm the test customer is listed or can be created.
5. Open the customer's Admin relationships area and confirm you can request a new GDAP relationship.
6. After the customer approves the relationship, confirm you can assign the approved roles to a partner security group.

If you cannot see customers, cannot request an admin relationship, or cannot assign roles to a partner security group, the tenant is not ready to test GDAP in Spotto. Use one of the dedicated service-principal setup paths until a Partner Center admin enables the required partner capability and access.

Microsoft Partner Center Setup

Complete these steps in Microsoft Partner Center before creating the Spotto customer cloud account.

1. Sign in to Partner Center as an admin agent.
2. Create or select the customer.
3. Request a GDAP relationship with the customer.
4. Choose the Microsoft Entra roles from Choose The Entra Roles. Choose the complete set now. Roles cannot be added later.
5. Send the approval request to the customer.
6. Ask the customer global admin to approve the request.
7. After approval, open the admin relationship and add the partner security group.
8. Assign the approved roles to that security group.
9. Complete Give Spotto Access To Azure Subscriptions. This is a separate step and it is the one most often missed.
10. If the customer is billed through your CSP account, complete Turn On CSP Billing Visibility.
11. Wait until the access assignment is active.
12. Copy the GDAP relationship ID and assigned partner security group ID for the Spotto setup step.

Microsoft's reference pages:

• Obtain granular admin permissions to manage a customer's service
• Customer approval of partner GDAP request
• Grant granular permissions to security groups
• Workloads supported by GDAP

Layer A: Choose The Entra Roles

Choose these roles when you request the relationship, before the customer approves it.

Microsoft Entra role	Needed	What it is for
Directory Readers	Required	Microsoft's documented least-privileged role for GDAP Azure access. Without it, the delegated sign-in cannot read the customer directory and nothing else works.
Cloud Application Administrator	Required unless the customer's own Global Administrator grants consent directly	Lets your partner admin grant the Spotto application consent inside the customer tenant. Not needed if you send the customer a consent handoff link instead.
Global Reader	Recommended	Directory Readers does not cover audit logs, role management and Privileged Identity Management, or app registrations. Add Global Reader if you want Spotto's identity and governance findings for this customer.
Security Reader	Optional	Defender for Cloud assessments and secure score.
Reports Reader	Optional	Microsoft 365 and Entra usage and activity reporting.

Roles cannot be added later

Microsoft does not allow roles to be added to a GDAP relationship after the customer has approved it. Adding a role means requesting a new relationship and asking the customer to approve again, then reassigning the security group and updating the relationship ID in Spotto. Choose the full set up front, including anything you expect to need in the next twelve months.

Reference: Obtain granular admin permissions to manage a customer's service.

note

Entra roles are Layer A only. None of the roles above grants a single Azure permission. Continue to Layer B.

Layer B: Give Spotto Access To Azure Subscriptions

GDAP Entra roles grant no Azure RBAC. Azure subscription access is granted one of two ways, depending on how the customer's Azure is billed.

If The Customer Is CSP Or Azure Plan

Azure access flows through the admin-on-behalf-of path, which depends entirely on group nesting in your partner tenant, not on the GDAP roles.

1. In your partner tenant, open Microsoft Entra ID and find the security group assigned to the GDAP relationship.
2. Open the Admin Agents group.
3. Add the assigned security group as a member of Admin Agents.
4. Confirm the partner user who authorizes the Spotto profile is a member of the assigned security group.
5. Wait for group membership to propagate, then validate in Spotto.

important

If the assigned security group is not nested under Admin Agents, Spotto finds no Azure subscriptions. The GDAP relationship will look completely healthy while this is missing, because the relationship and the Azure path are checked separately.

If The Customer Is Enterprise Agreement Or MCA-Direct

The admin-on-behalf-of path does not apply. The customer assigns Azure RBAC directly to your partner security group.

Azure role	Assign at	Needed for
Reader	Subscription, or a management group that covers them	Required minimum. Resource inventory, Resource Graph, and Advisor.
Cost Management Reader	Subscription	Cost trends, budgets, and savings analysis.
Monitoring Reader	Subscription	Metrics, performance evidence, and rightsizing.
Log Analytics Reader	Subscription or workspace	Log Analytics and Application Insights evidence.
Security Reader	Subscription	Defender for Cloud assessments and secure score.
Management Group Reader	Root management group	Management group hierarchy and tenant governance context.
Reservations Reader and Savings plan Reader	Reservations and savings plan provider scopes	Commitment inventory, coverage, utilization, and expiry.

Full assignment steps for each role are in Azure Cloud Account Permissions.

Layer C: Turn On CSP Billing Visibility

Only needed when you bill the customer's Azure through your CSP account and you want cost data. Do this in your own partner tenant, not the customer's.

1. Open Cost Management + Billing.
2. Select the billing account.
3. Open Customers and choose the customer.
4. Open Policies.
5. Set Azure Usage to Yes.

You need to be an Admin agent and a Billing admin in the partner tenant to change this policy.

note

Missing Layer C degrades the account rather than blocking it. Spotto still connects, scans resources, and reports governance findings, but cost figures are empty or partial until Azure Usage is on. More detail is in CSP Billing Prerequisites.

caution

Creating Cost Management billing exports is not supported under GDAP. Microsoft does not permit export creation through the delegated admin path, so this is by design rather than a Spotto limitation. Use one of the service principal setup paths for a customer who needs export-based billing ingestion.

Customer Approval Checklist

Send this checklist to the customer approver with the Microsoft approval link.

The customer should confirm:

• The partner name is correct.
• The requested roles match the agreed support or management scope.
• The relationship duration is expected.
• The approval request is for the correct customer tenant.
• The customer understands they can remove the relationship or delegated access later.

After approval, the customer can return to the partner. The partner still needs to assign the approved roles to the correct partner security group, and complete Layer B, before Spotto can use the relationship.

If the customer's security reviewer wants to know what the partner side of this grants, send them Partner Access And Consent. It lists the exact permissions, states plainly that they grant no Azure access and no access to any customer tenant, and explains what each customer still has to approve separately.

Create The Partner Authorization Profile In Spotto

Create one partner authorization profile in the partner root company for each Spotto region where customer data will be scanned.

1. In Spotto, switch to the partner root company.
2. Open Connectors, then select Cloud Accounts.
3. Select Add Cloud Account.
4. Select Show More, then choose Granular Delegated Admin Privileges.
5. In Authorization profile, create or select the partner profile.
6. Enter a clear profile name, such as Partner GDAP.
7. Enter the partner tenant ID.
8. Select Create Profile.
9. Select Authorize Profile.
10. Sign in with the partner identity that is allowed to use the GDAP relationship.
11. Approve the Microsoft authorization and return to Spotto.

The profile must show a ready status before customer GDAP cloud accounts can be saved.

The Microsoft approval in step 11 needs an administrator. If you are not one, select Create approval link instead and send the generated link to a Global Administrator. They approve with their own Microsoft account and do not need a Spotto login. See Hand The Approval To A Global Administrator.

For exactly what this approval grants, and what it does not, see Partner Access And Consent. It is written so you can send it to a customer's security reviewer.

Spotto stores the authorization profile and refresh tokens in the selected Spotto region. For example, a customer onboarded in the USA region uses the USA Spotto environment, callback URL, credential storage, and repositories. A customer onboarded in Europe uses the Europe environment and storage. Tokens are not shared across regions.

Create A Customer GDAP Cloud Account

Create a separate GDAP cloud account inside each customer company.

1. In Spotto, switch to the customer company.
2. Open Connectors, then select Cloud Accounts.
3. Select Add Cloud Account.
4. Select Show More, then choose Granular Delegated Admin Privileges.
5. Select the ready partner authorization profile.
6. Enter an account name that identifies the customer tenant.
7. Enter the customer tenant ID.
8. Enter the GDAP Relationship ID, not its display name. See Copy IDs, Not Display Names.
9. Enter the partner Security Group Object ID, not its group name.
10. Open Optional GDAP Details only if you also want to record the access assignment ID.
11. Confirm the Spotto application consent has been granted in the customer tenant. See Grant The Customer Tenant Consent below.
12. Select Validate GDAP Access.
13. Review the capability results, then select the subscriptions this customer company should scan.
14. Select Save and Start Scan.

Spotto only stores the subscriptions you select on this screen.

Validation does not create a cloud account

Validate GDAP Access only checks the values against Microsoft and returns the subscriptions that are readable. Nothing appears in Cloud Accounts yet. After validation is Ready, select at least one subscription and choose Save and Start Scan. That action creates the cloud account under the Spotto company currently selected in the company selector and queues its first scan.

If the MSP root company is selected, Spotto warns that the account will be saved there. Switch to the customer company before saving a customer-owned GDAP account.

Grant The Customer Tenant Consent

The customer tenant must approve the Spotto application separately. This is tenant-wide Microsoft admin consent; it is not granted when the customer approves the GDAP relationship, and a confirmation inside Spotto cannot grant it. Until Microsoft confirms the approval, Application consent shows as Blocked and validation cannot pass.

The simplest path is:

1. In the blocked Application consent result, select Create customer approval link.
2. Copy the link and send it to a Global Administrator in the customer's tenant.
3. Ask the administrator to open the link, confirm the displayed tenant, sign in with their Microsoft account, review the requested permissions, and approve.
4. Return to Spotto and select Validate GDAP Access again.

The customer administrator does not need a Spotto account.

Option	Who does it	What it needs
Grant it yourself through the relationship	Your partner admin	The partner user must be in the assigned GDAP security group and under Admin Agents, and the relationship must include Cloud Application Administrator or Application Administrator
Send an approval link to the customer	The customer's Global Administrator	Select Create customer approval link, send it to the customer's Global Administrator, and they approve with their own Microsoft account without a Spotto login

note

If the customer's Global Administrator grants consent directly, Cloud Application Administrator is not needed in the GDAP relationship at all. Deciding this before you request the relationship keeps the requested role set smaller, which customers approve more readily.

Full detail on both options, including what the approval link does and does not return, is in Partner Access And Consent.

Spotto validates the Microsoft and Azure access path before any recurring scan is allowed. When Microsoft returns a rotated refresh token, Spotto persists the new token so long-term scanning can continue without asking the partner to reauthorize every day.

What The First Scan Checks

The setup form checks that the selected profile is authorized and that the customer tenant, GDAP relationship, and partner security group values are present. A newly authorized profile can be used for its first customer validation immediately; customer validation status is tracked separately from partner authorization status.

Validation then runs deeper live checks in a fixed order, and stops at the first blocking failure. The check that fails tells you which access layer to fix, so read the results top down and fix only the first blocked item.

Order	Check shown in Spotto	Layer	What it means when it is not ready
1	Partner authorization	A	The partner profile could not obtain Microsoft tokens. Reauthorize the profile in the partner root company.
2	GDAP relationship	A	The relationship is missing, expired, terminated, or belongs to a different customer tenant.
3	Access assignment	A	The partner security group is not assigned to the relationship, or the assignment is still pending.
4	Application consent	A	The Spotto application has not been approved inside the customer tenant. See Grant The Customer Tenant Consent.
5	Subscription discovery	B	Delegated access works, but no Azure subscriptions are readable. This is almost always the missing Admin Agents nesting, or missing Azure RBAC for EA and MCA-direct. See Layer B.
6	Resource Graph and Resource inventory	B	Subscriptions are visible but resources cannot be read. Usually Reader is missing or has not propagated.
7	Cost read	B	Degrades rather than blocks. Cost Management read access is missing on the subscriptions.
8	Partner Billing Cost Read	C	Degrades rather than blocks. CSP Azure Usage visibility is off in the partner billing account. See Layer C.

Checks 1 to 6 block the account. Checks 7 and 8 show as Degraded: the account still connects and scans, but cost data is incomplete.

If the first scan reports missing access, use Azure Cloud Account Permissions and Azure Cloud Account Troubleshooting to resolve the specific warning.

Ongoing Operation

After setup:

• Spotto scans GDAP customer cloud accounts only when validation passes and scheduled scanning is enabled for that account.
• Refresh tokens are stored encrypted and rotated when Microsoft returns a replacement token.
• Each customer company keeps its own cloud account, scan history, subscriptions, and findings.
• Each Spotto region keeps its own authorization callback URL, credentials, and token storage.
• If the customer removes the GDAP relationship or the partner removes the security group assignment, scans fail until access is restored.

Common Problems

Symptom	Likely Cause	Fix
The profile cannot be selected for a customer account	The partner profile is not ready or the authorization failed	Reauthorize the profile from the partner root company.
Validate GDAP Access is unavailable	The partner profile is not authorized, or a required customer tenant, relationship, or security group value is missing	Complete the guidance shown below the button, then validate again.
GDAP relationship is blocked immediately	A relationship display name was entered instead of its ID, the ID belongs to another customer, or partner authorization cannot read it	Copy the relationship Id using Copy IDs, Not Display Names, confirm the customer tenant, then validate again.
The security-group field says the Object ID is invalid	A group display name such as CPM Admins was entered	In the partner tenant, open the group in Microsoft Entra and copy its 36-character Object ID GUID.
The customer cloud account cannot be saved	Validation has not passed, or a required account value is missing	Re-check the account name, customer tenant ID, GDAP relationship ID, and partner security group ID.
Application consent is blocked	The Spotto application has not been approved in the customer tenant	Grant it through the relationship, or send the customer's Global Administrator an approval link.
Validation finds no subscriptions	Layer B is missing. GDAP is active, but no Azure access has been granted	For CSP/Azure Plan, nest the assigned security group under Admin Agents. For EA and MCA-direct, ask the customer to assign Azure RBAC. See Layer B.
A role is missing from the relationship	Roles cannot be added after approval	Request a new GDAP relationship with the full role set, have the customer approve it, reassign the security group, and update the relationship ID in Spotto.
The person doing setup cannot approve the Microsoft consent	They are not a Global Administrator	Select Create approval link or Create customer approval link, as shown, and send it to the relevant tenant administrator. See Partner Access And Consent.
Billing data is missing	CSP Azure Usage visibility or Cost Management read access is incomplete	Review Layer C and CSP Billing Prerequisites. GDAP billing export creation is not supported.
Scans stopped after working previously	The customer removed the GDAP relationship, the assignment expired, or Microsoft revoked the refresh token	Re-establish the GDAP relationship or reauthorize the Spotto partner profile.

Related Pages

• Partner Access And Consent
• Azure Cloud Account Permissions
• Azure Cloud Account Troubleshooting
• Parent And Child Companies