> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft CSP

> Connect Triggr to Partner Center as your service account, so it can list your CSP customers and grant its GDAP app consent.

Microsoft CSP signs Triggr in to Partner Center as your [GDAP service account](/integrations/microsoft-graph/gdap-service-account), so it can list your customers, grant or remove its app consent in clients' tenants, and check clients in the GDAP Setup Wizard. Listing customers needs only Microsoft CSP; the rest also needs Microsoft Graph (GDAP).

## Prepare the service account

<Steps>
  <Step title="Create the service account">
    Follow [Create the service account](/integrations/microsoft-graph/gdap-service-account#create-the-service-account) and keep Global Administrator on it until you finish this page: only a Global Administrator who is also an Admin Agent can consent to a partner app.
  </Step>

  <Step title="Check it's an Admin Agent">
    In Partner Center, go to **Account settings > User management**, open the service account and make sure Admin Agent is selected. Changes made in Microsoft Entra take up to an hour to show here.
  </Step>

  <Step title="Enforce MFA">
    Require Microsoft MFA on every sign-in for the account (see [Conditional Access](/integrations/microsoft-graph/conditional-access)). Partner Center rejects requests without it.
  </Step>
</Steps>

## Connect it in Triggr

<Steps>
  <Step title="Open the integration">
    Go to **Integrations > Microsoft CSP** and click Configure on the Base Configuration card.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=bb81acb082055015f91beda7b4876f35" alt="The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button." width="2272" height="330" data-path="images/integrations-common/base-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter your partner tenant">
    Leave Use default config selected, enter your own partner tenant's ID in TenantID (not a client's) or use Lookup By Domain, and click Save Configuration.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/microsoft-graph-csp/configure.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=5a96752d47f941f61a8b6656ec4beb8b" alt="The Microsoft CSP configuration window with App Registration set to Use default config, a TenantID field with a Lookup By Domain link, an Allow insecure TLS switch under Advanced, and a Save Configuration button." width="1344" height="1042" data-path="images/microsoft-graph-csp/configure.png" />
    </Frame>
  </Step>

  <Step title="Grant admin consent and authorize">
    Click **Admin Consent** and accept as the service account, then click **Authorize** and sign in as the service account with MFA.
  </Step>
</Steps>

Microsoft CSP is one connection for your organisation, with nothing to set up per client. Workflows can use the List Customers action and the Grant GDAP Consent and Remove GDAP Consent steps; Remove GDAP Consent removes all of Triggr's delegated access to a client's tenant.

## Use your own app registration

Only do this if your policies require an app registered in your own tenant. See Microsoft's [Secure partner application](https://learn.microsoft.com/en-us/partner-center/developer/secure-sample-application).

<Steps>
  <Step title="Register the app">
    In the [Microsoft Entra admin centre](https://entra.microsoft.com), go to **Entra ID > App registrations > New registration**, choose Multiple Entra ID tenants, add the Web redirect URI `https://app.triggr-app.com/oauth/callback`, select Register and copy the Application (client) ID.
  </Step>

  <Step title="Add the admin consent redirect URI">
    Under **Manage > Authentication**, add a second Web redirect URI, `https://app.triggr-app.com/oauth/admin-consent-callback`.
  </Step>

  <Step title="Add delegated permissions">
    Under **Manage > API permissions**, add only the Delegated permissions `user_impersonation` on Microsoft Partner Center (under APIs my organization uses) and `offline_access` on Microsoft Graph.
  </Step>

  <Step title="Create a client secret">
    Under **Manage > Certificates & secrets**, select New client secret and copy its Value. Microsoft shows it only once.
  </Step>

  <Step title="Enter it in Triggr">
    Select **Use custom app reg**, fill in ClientID, ClientSecret and TenantID, then click Save Configuration, Admin Consent and Authorize. Replace the secret here before it expires.
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Your organisation isn't connected to Microsoft Partner Center">
    Check Status is Configured and TenantID is your partner tenant's ID, then click Authorize and sign in again as the service account.
  </Accordion>

  <Accordion title="401 MFA required">
    Enforce Microsoft MFA on every sign-in for the service account, then click Authorize again.
  </Accordion>

  <Accordion title="Partner Center rejected Triggr's sign-in for this consent change">
    Partner Center answered `Unable to initialize the authorization context`. Check the client's GDAP relationship is active and the service account is still in AdminAgents, then click Authorize again and retry.
  </Accordion>

  <Accordion title="Customer not found in Partner Center">
    The client's tenant ID in Microsoft Graph (GDAP) doesn't match a Partner Center customer with a relationship to you (No relationship to partner (none)). Check the ID, then the customer's relationship in Customers.
  </Accordion>

  <Accordion title="The sign-in window asks for administrator approval">
    Admin consent hasn't been granted for the app. Click Admin Consent and sign in as the service account while it's still a Global Administrator, then click Authorize again.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.