Skip to main content
With GDAP, Triggr connects each linked client to Microsoft 365 by itself and shows a warning only when a person needs to act. Once a client is linked (by the Microsoft setup, the assistant, Link to GDAP or Link all), Triggr grants its consent, sets up Exchange, then tests sign-in and Exchange. If something Triggr fixes still fails, it tries again after 2 hours, then 6 hours; after the third try, or 24 hours, the client shows the problem. Triggr never changes your GDAP relationships, roles, security groups or Conditional Access. Click the warning in the client’s panel, under GDAP health, for its steps and an Open Partner Center, Open Conditional Access or Open the client’s admin centre button, plus Test again, Fix now (admins, for what Triggr fixes itself), Try again (admins, once you’ve done your part) and Ask the assistant, which diagnoses the connection and can test or retry it.

​
Triggr fixes these by itself

App not consented, Consent didn’t apply, Exchange didn’t connect, Not linked to GDAP, Microsoft is busy and Needs a look show only after Triggr’s three tries. An admin clicks Fix now in the client’s panel to let Triggr try again; if it fails again, contact Triggr support.

​
Needs you in Partner Center

​
No GDAP relationship

Microsoft refused Triggr’s partner sign-in to the client (AADSTS50020, 90072 or 50177): the GDAP relationship is missing, expired or removed.
  1. In Partner Center, open Customers, select the client and open Admin relationships.
  2. Check for an active GDAP relationship. If there isn’t one, click Request for new relationship, add the roles Triggr needs and send the link to the client’s Global Administrator to approve.
  3. Once it’s approved, assign the roles to the security group Triggr’s account is in.

​
Relationship not active

The client’s GDAP relationship is pending approval, expiring, expired or terminated, so Triggr’s access hasn’t started or is about to stop.
  1. In Partner Center, open Customers, select the client and open Admin relationships.
  2. Pending approval: resend the approval link to the client’s Global Administrator.
  3. Expiring, expired or terminated: request a new admin relationship with the same roles and have the client approve it.

​
Needs a GDAP role

The client’s GDAP relationship doesn’t include a role Triggr needs; the warning names it.
  1. In Partner Center, open Customers, select the client and open Admin relationships.
  2. Click Request for new relationship and include the role (roles can’t be added to an existing relationship).
  3. Send the approval link to the client’s Global Administrator.
  4. Once approved, open the relationship, click Add security groups and give the role to the group Triggr’s account is in.
  5. Click Test again.

​
Group not assigned

The relationship includes the role, but it isn’t assigned to a security group Triggr’s account is in.
  1. In Partner Center, open Customers, select the client and open Admin relationships.
  2. Open the active relationship and click Add security groups.
  3. Pick the security group Triggr’s account is in, tick the role and save.
  4. Click Test again (Microsoft can take a few minutes).

​
Needs Privileged Role Admin

Microsoft refused (403) when Triggr tried to give its app Exchange access: the GDAP relationship doesn’t include Privileged Role Administrator.
  1. In Partner Center, open Customers, select the client and open Admin relationships.
  2. Request a new admin relationship that includes Privileged Role Administrator (roles can’t be added to an existing one), and have the client approve it.
  3. Assign Privileged Role Administrator to the security group Triggr’s account is in.
  4. In Core, open the client and click Repair.
Without the role, grant Exchange access yourself. Partner Center wouldn’t let Triggr grant its app access in the client. Under GDAP that needs the Cloud Application Administrator role.
  1. In Partner Center, open Customers, select the client and open Admin relationships.
  2. Check the active relationship includes Cloud Application Administrator. If it doesn’t, request a new relationship that does and have the client’s Global Administrator approve it (roles can’t be added to an existing one).
  3. Assign Cloud Application Administrator to the security group the account you connected Triggr with is in.
  4. Make sure that account is an Admin agent in Partner Center (Account settings > User management).
  5. Click Try again on the client: Triggr grants its consent.

​
Partner Center refused

Partner Center couldn’t authorise Triggr’s account for the client: the account isn’t an Admin agent, or the client’s relationship isn’t active.
  1. In Partner Center, open Account settings > User management and give Triggr’s account the Admin agent role.
  2. Open Customers, select the client and check its admin relationship is active.
  3. Click Test again.

​
Access denied

Microsoft refused the request (403): Triggr’s GDAP roles or its consent don’t cover it.
  1. In Partner Center, open Customers, select the client and open Admin relationships.
  2. Check the active relationship includes a role that covers the failing check, assigned to the security group Triggr’s account is in.
  3. If it does, open the client in Core and click Repair to renew Triggr’s consent, then click Test again.

​
Needs you in Microsoft Entra

​
Account not in group

The role is assigned to a security group, but Triggr’s partner account isn’t a member of it.
  1. In your partner tenant’s Entra admin centre, open Groups > All groups and open the group.
  2. Open Members > Add members, add the account Triggr signs in with, and save.
  3. Click Test again (Microsoft can take a few minutes).

​
Needs the client’s admin

​
Blocked by Conditional Access

A Conditional Access policy in the client’s tenant blocked Triggr’s partner sign-in (MFA, a compliant device or a location rule). The client’s admin does this:
  1. Sign in to the client’s Entra admin centre as a Conditional Access Administrator.
  2. Open Entra ID > Conditional Access > Policies.
  3. In each policy that applies to all users or to guest and external users, open Users > Exclude.
  4. Tick Guest or external users > Service provider users, and save.
See Your clients’ tenants.

​
Needs you in Core

​
No tenant ID

The client has no Microsoft tenant ID in Core, so Triggr can’t link it to Microsoft.
  1. In Partner Center, open Customers, select the client and copy its Microsoft ID.
  2. In Core, open the client and paste it as the Microsoft tenant ID.
  3. Save; Triggr connects the client automatically.

​
Tenant not found

Microsoft has no tenant with the tenant ID saved on the client (AADSTS90002).
  1. In Partner Center, open Customers, select the client and copy its Microsoft ID.
  2. In Core, open the client, paste it as the Microsoft tenant ID and save.
  3. Click Link to GDAP, then Test again.
Triggr refused to link the client to its Microsoft tenant automatically.
  1. Open the client in Core and check its Microsoft tenant ID is the client’s own.
  2. If another client already uses the same tenant ID, remove it from one of them.
  3. Click Test again.
Triggr’s consent in the client is from an older permission set. Renewing it removes access for a minute or so, so Triggr only does it when you click Repair.
  1. Open the client in Core and click Repair: it renews Triggr’s consent with every permission.
  2. Click Test again after 2 minutes.

​
Partner sign-in expired, or App secret expired

Microsoft says Triggr’s sign-in to your Partner Center account has expired or was revoked (AADSTS700082, 70008, 50173 or 700084), or rejected the client secret on your Microsoft Graph (GDAP) connection (AADSTS7000215 or 7000222), so no client can be reached. Clients shows a banner that every client is affected.
  1. On the Clients page, click Renew (or on Home, open Microsoft 365 › Review setup).
  2. At the Sign in step, sign in again with the service account Triggr uses.

​
Partner account can’t sign in

The partner account Triggr signs in with doesn’t exist, is disabled or has no session (AADSTS50034, 50057 or 50058).
  1. In Partner Center, open Account settings > User management.
  2. Check the account Triggr uses exists, is enabled and is an Admin agent.
  3. On the Clients page, click Renew (or on Home, open Microsoft 365 › Review setup). At the Sign in step, sign in again with that account.

​
Needs you in the client’s Microsoft 365

​
Mailbox not found

Exchange Online couldn’t find the mailbox: the user has no Exchange licence yet, or the address is wrong.
  1. In the client’s Microsoft 365 admin centre, open Users > Active users and find the user.
  2. Check they have a licence that includes Exchange Online, and their email address is the one used.
  3. A new mailbox can take up to 30 minutes to appear after the licence is added. Run the workflow step again.
More about GDAP, consent and Repair: Microsoft and GDAP FAQ.