Skip to main content
For the setup steps, see Connect Microsoft 365 and Add your clients.

​
Before you start

GDAP (Partner Center) if you’re a CSP partner with GDAP relationships: one sign-in reaches every client. Otherwise Per-client app: each client’s Global Administrator approves Triggr once.
No. One Default Microsoft connection (Settings > General) applies to every client, and changing it moves every Microsoft workflow at once, so connect your clients the new way first.
Partner Center access as an Admin agent, an active GDAP relationship with each client that includes the recommended roles, an admin in your own tenant who can create users and assign Entra roles, and a way to require MFA on the service account (Conditional Access or per-user MFA).
Core connects through GDAP or a per-client app. If Choose how to connect says “Connected via CIPP today”, confirming a card moves your Microsoft workflows off CIPP straight away, so connect each client the new way first.
Set their environment to Cloud + On-Prem (synced) and deploy the desktop agent. Core then makes user changes in Active Directory (which workflows), and GDAP health stops asking for the Entra roles those changes would otherwise need.

​
GDAP relationships and roles

GDAP is Microsoft’s time-limited, role-based partner access to a customer’s tenant, replacing DAP (Microsoft’s GDAP FAQ). Core acts only within the roles a client’s relationship gives Triggr’s security group, and GDAP health looks for that relationship, so move DAP clients to GDAP.
The recommended set, or the narrower alternatives. Global Administrator isn’t needed, and Microsoft won’t auto-extend a relationship that includes it. GDAP health names any role a client lacks, for example “Needs User Administrator for Onboarding”.
No. Request a new relationship that includes it and, once approved, assign the role to Triggr’s security group.
No. Partner Center assigns roles to security groups, so put the service account in a group and give that group its roles in each relationship. See Give the account access to your clients.
Up to two years; with Auto Extend on, Microsoft extends it six months at a time. In the last 30 days of one that doesn’t auto-extend, the client shows Expires in N days, the Expiring filter on Clients lists it, and GDAP alerts can email your team.
No. Request a new one, assign Triggr’s security group its roles again, then click Check now in the client’s GDAP health.
An admin clicks Sign in with Triggr’s service account and signs in as the account Core already uses. Signing in as anyone else changes the access Triggr uses for every client.

​
The service account

Membership of AdminAgents and your GDAP security groups, Global Administrator until setup is finished, MFA, and a Conditional Access exclusion with its own MFA policy. See Create the service account.
Only to approve Triggr’s app in your tenant: Microsoft requires the approver to be a Global Administrator and Admin Agent. Remove it on the Done step (Open Entra) once every sign-in is finished.
No. Mailbox steps run as Triggr’s own app, never through the account’s mailbox.
Yes. Partner Center rejects requests unless the sign-in used MFA. If you add MFA after setup, redo Connect Microsoft Graph and Connect Partner Center.
In your tenant, policies that require a compliant or hybrid-joined device or allow only named locations. In clients’ tenants, exclude your partner tenant’s service provider users. See Conditional Access.
Choose Use another account in Microsoft’s window. Every client uses this sign-in, so signing in as yourself changes the access Triggr uses for all of them.
Microsoft revokes Triggr’s sign-in (as it does if someone revokes the account’s sessions). Clients shows “Triggr’s Microsoft sign-in needs renewing — every client is affected.” and each client reads Check org sign-in. Click Renew, then Redo on Connect Microsoft Graph and Connect Partner Center, signing in as the service account with MFA.
No. Triggr refreshes it in the background; you sign in again only if Microsoft revokes it.
Approve Triggr’s app gives admin consent in your own tenant. Connect Microsoft Graph is the service account sign-in Core uses in clients’ tenants, and Connect Partner Center lets Core list your customers and grant its consent in their tenants.
Delegated Microsoft Graph permissions granted through Partner Center, plus Exchange.ManageAsApp for Exchange Online. With GDAP, Triggr can use them only within the roles the client’s relationship gives Triggr’s security group.The Graph permissions are Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, AuditLog.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementManagedDevices.Read.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementServiceConfig.Read.All, Directory.AccessAsUser.All, Directory.Read.All, Directory.ReadWrite.All, Files.ReadWrite.All, Group.ReadWrite.All, GroupMember.ReadWrite.All, IdentityRiskEvent.Read.All, IdentityRiskyUser.Read.All, Member.Read.Hidden, offline_access, Organization.Read.All, Policy.Read.All, RoleManagement.Read.Directory, SecurityEvents.Read.All, Sites.Manage.All, Sites.ReadWrite.All, TeamsTelephoneNumber.ReadWrite.All, User.DeleteRestore.All, User.EnableDisableAccount.All, User.Export.All, User.Invite.All, User.ManageIdentities.All, User.Read, User.ReadWrite.All, User.RevokeSessions.All and UserAuthenticationMethod.ReadWrite.All.
Triggr’s app has no consent in the client’s tenant yet. In the client’s GDAP health, click Grant app consent, then Grant consent, or click Repair; both need Cloud Application Administrator in the relationship. Microsoft takes a minute or two to apply it, so wait before Check now, or if Repair says “Microsoft is still applying Triggr’s new consent”.
Triggr’s consent in that client is from an older permission set. Click Repair: it removes the consent and grants it again, so Triggr can’t reach the client for a minute or so.

​
Linking clients

Adding puts the client on Clients with its tenant ID; linking lets Core reach that tenant through GDAP. The Microsoft setup’s Add clients step does both; Import > Microsoft Partner Center only adds, so click Link all afterwards.
Click Add client on Clients and enter its domain, then open it and click Link to GDAP. It still needs an active GDAP relationship that gives Triggr’s security group its roles.
No; Core only needs the GDAP relationship, which Partner Center lets you request from a customer you don’t resell to. Clients you can’t reach through GDAP need Per-client app, which then applies to every client.
Set up Microsoft access works on three clients at a time, 20 seconds to 2 minutes each. Keep the tab open; finish any later with Set up Microsoft access for all clients on the Add clients step.

​
Health checks and repairs

Every night at 03:30 UTC: each GDAP-linked client’s Microsoft sign-in, Graph permissions, Admin roles and GDAP relationship, plus Recent failures from the last 7 days. Check sooner with Check now in the client’s GDAP health (once a minute) or Check all on Clients (once every 10 minutes).
It grants or replaces Triggr’s consent in the client’s tenant, adds the client’s Exchange connection and gives Triggr’s app Exchange access, then re-checks, skipping anything already in place. It never changes GDAP relationships or roles. Admins only, at most once every six minutes per client.
It counts the workflows not set to Disabled on Config, and only the steps turned on in them. Set an unused workflow to Disabled, or add the role named under Won’t fully work here.
Microsoft didn’t let the service account into the client’s tenant. Check the relationship is Active in Partner Center (not Approval Pending), Triggr’s security group has an Active role assignment in it, the service account is in that group, and the client’s Microsoft tenant ID is its own.
A policy in the client’s tenant blocked the service account. Exclude your partner tenant’s service provider users, as in Your clients’ tenants, then click Check now.
GDAP health checks what your enabled workflows need. Connection Audit and Check permissions also test reads such as Devices, Risky users and Security alerts that Core’s workflows don’t use.

​
Per-client app instead of GDAP

A Global Administrator of your tenant approves Triggr’s app on Approve the app. Then each client’s Global Administrator approves it from Approve clients, or the Approve access button in the client’s panel while it reads Needs approval.
No. To test a client’s access, click Check permissions under Microsoft connection in its panel, or use Connection Audit on Clients.

​
Exchange Online

As Triggr’s own app through Exchange Online PowerShell, not as the service account. In each client’s tenant the app needs Exchange.ManageAsApp and the Exchange Administrator role, which Repair sets up for GDAP clients. See Microsoft Exchange.
The client has no Exchange connection in Triggr yet. Click Repair in the client’s GDAP health; with a per-client app, click Set up Microsoft access for all clients on the Approve clients step.
Repair needs Privileged Role Administrator in the relationship to give Triggr’s app the Exchange Administrator role. Add it for Triggr’s security group and run Repair again, or grant Exchange access yourself.

​
Access, data and security

With GDAP, remove Triggr’s security group from the relationship or terminate it in Partner Center, and delete Triggr’s enterprise app (application ID e0ce32ae-7ba3-4f66-b686-d22dd0eb7841) from the client’s tenant, since mailbox steps run as that app. With a per-client app, the client’s admin deletes Triggr’s enterprise apps there.
From Triggr’s cloud; only on-premises Active Directory changes go through the desktop agent. If a Conditional Access policy allows only named locations, exclude the service account or add Triggr’s IP addresses.
Triggr never sees the password: you sign in on Microsoft’s own page. It keeps the sign-in tokens, encrypted with keys unique to your organisation, plus each client’s tenant ID and domain and its latest GDAP health results.
Only admins can run Set up Microsoft access, Repair and Sign in with Triggr’s service account, and change GDAP alerts. Members can view GDAP health and click Check now and Check all. See roles.

​
Errors you might see

It can also read “microsoftGDAP integration is not configured for tenant …”. The client isn’t linked: open it on Clients, click Link to GDAP, then run the workflow again. With a per-client app the message names Microsoft Graph (SAM) or microsoftSAM; click Approve access instead.
Microsoft rejected the app ID or client secret saved for Microsoft Graph (GDAP). If you use your own app registration, put a new client secret on its Base configuration in Integrations; otherwise contact Triggr support.
On the Microsoft setup’s Sign in step, click Sign in (or Redo) on Connect Partner Center, sign in as the service account, then try again.
Either Default Microsoft connection isn’t GDAP, or Triggr’s own Microsoft sign-in needs fixing. Check Settings > General, then redo the sign-ins on the Sign in step.