> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft Graph (GDAP)
> Connect Triggr to your clients' Microsoft 365 tenants through GDAP, with one service account in your partner tenant.
Triggr signs in once as a service account in your partner tenant, then works in each client's tenant with the roles its GDAP relationship allows. There's no app to register and nothing for your clients to install.
You need a CSP partner tenant with [Partner Center](https://partner.microsoft.com/dashboard/home) access as an Admin agent, a Global Administrator or Privileged Role Administrator in your partner tenant, and MFA through [Conditional Access](/integrations/microsoft-graph/conditional-access) (Microsoft Entra ID P1 or P2) or per-user MFA.
In Triggr Core, Connect Microsoft 365 on Home walks you through the Triggr side of this page. Do the Partner Center and Microsoft Entra steps here first. See [Connect Microsoft 365](/core/get-started/connect-microsoft-365).
## Request a GDAP relationship with each client
Skip any client whose active relationship already includes the roles you need.
In Partner Center, select Customers, the customer, then **Admin relationships > Request for new relationship** (or **Administer > Request admin relationship** for a customer with no reseller relationship).
Enter a name the client will see, set Duration in days (up to 730), tick the [recommended roles](/integrations/microsoft-graph/recommended-roles) and select Save.
Set Auto Extend to Yes, select **Finalize request** and send the request email, unchanged, to a Global Administrator at the client. The relationship is active once they approve it.
Roles can't be added to a relationship later: request a new one instead. Microsoft doesn't auto-extend a relationship that includes Global Administrator. See Microsoft's [Obtain granular admin permissions](https://learn.microsoft.com/en-us/partner-center/customers/gdap-obtain-admin-permissions-to-manage-customer).
## Create the service account
In the [Microsoft Entra admin centre](https://entra.microsoft.com) for your partner tenant, go to **Entra ID > Users > New user > Create new user** and create a user such as `triggr@yourcompany.com` with a strong password stored in your password manager. It needs no licence.
Under Assignments, add the **AdminAgents** group (only Admin agents can list your customers and grant Triggr's consent) and the **Global Administrator** role (needed only to grant admin consent; you remove it at the end), then select Create.
Add the account to a [Conditional Access policy that requires MFA](/integrations/microsoft-graph/conditional-access#require-mfa-for-the-service-account) or turn on per-user MFA, exclude it from policies that require a compliant device or allowed locations, then sign in as it once and register an MFA method your team can reach.
Partner Center rejects sign-ins without MFA, and changes in Microsoft Entra take up to an hour to reach Partner Center. See Microsoft's [MFA requirements for partner tenants](https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements-mandating-mfa).
## Give the account access to your clients
In **Entra ID > Groups > New group**, create a Security group such as `Triggr GDAP` with the service account as a member.
In Partner Center, open the client's relationship under Admin relationships, select **Add security groups**, tick Triggr's group, tick the [recommended roles](/integrations/microsoft-graph/recommended-roles) and select Save. The assignment shows Active after about 30 seconds. Repeat for each client.
You can only assign roles the relationship includes. See Microsoft's [Grant granular permissions to security groups](https://learn.microsoft.com/en-us/partner-center/customers/gdap-assign-microsoft-entra-roles).
## Connect it in Triggr
On Home, click **Set up** next to Connect Microsoft 365 and follow [Connect Microsoft 365](/core/get-started/connect-microsoft-365). Its Sign in step grants admin consent, authorises Microsoft Graph and connects Partner Center, each time as the service account.
Go to **Integrations > Microsoft Graph (GDAP)** and click Configure on the Base Configuration card.
Leave Use default config selected (Triggr's app, `e0ce32ae-7ba3-4f66-b686-d22dd0eb7841`). In TenantID, enter your own partner tenant's ID, not a client's: click Lookup By Domain and enter `yourcompany.onmicrosoft.com`, or copy it from Entra ID > Overview. Click Save Configuration.
Click **Admin Consent**, sign in as the service account and select Accept. Admin Consent changes to Granted.
Click **Authorize** and sign in as the service account, never as yourself, with MFA. Every client uses this sign-in.
Set up [Microsoft CSP](/integrations/microsoft-graph/csp) with the same account. Triggr uses it to grant its app consent in your clients' tenants.
Once Admin Consent shows Granted on both integrations, remove Global Administrator from the service account in Microsoft Entra. Keep it in AdminAgents and Triggr's security group. Workflows that run without a client use the Base Configuration, in your own tenant.
## Make GDAP your default Microsoft connection
In Studio, go to **Settings > Org Variables**, click Setup Wizard and choose GDAP under Preferred Microsoft Connection Method; in Triggr Core, set Default Microsoft connection in Settings > General. Steps with Connection Type set to Automatic then use GDAP, and each client's page shows a GDAP Health card. For one step only, set its Connection Type to Microsoft Graph (GDAP).
## Link each client
Per-client integrations never fall back to the Base Configuration, so each client needs its own tenant ID. In Triggr Core, import your customers from Partner Center and click Link all on Clients instead; see [Add your clients](/core/get-started/add-your-clients#add-clients).
* One client: click Configure on its row, enter its TenantID (or click Lookup By Domain and enter any domain verified in the client's tenant) and click Save Configuration.
* Many clients: click **Automap**, then **Approve All**. It links every unlinked client that has a `microsoftTenantId` variable and tells you how many it skipped.
Saving writes the client's `microsoftTenantId` variable and creates its [Microsoft Exchange](/integrations/microsoft-exchange) configuration from the tenant's default domain. Linked clients show GDAP Setup instead of Admin Consent and Authorize.
## Grant Triggr's app consent in each client
Triggr grants its consent through Partner Center, so it needs [Microsoft CSP](/integrations/microsoft-graph/csp) connected as the service account and Cloud Application Administrator (or Application Administrator) assigned to Triggr's group in the client's relationship.
* One client: on its GDAP Health card, click **Grant app consent**, then Grant consent. Or click Repair, which also sets up Exchange.
* Every client: on Clients, click **Repair all**, then Repair.
* From a workflow: use the Grant GDAP Consent step. Remove GDAP Consent removes all of Triggr's access to a client's tenant.
Microsoft takes a minute or two to apply a new consent; if a check straight afterwards still fails, wait and click Check now.
## Set up Exchange for mailbox steps
Mailbox steps run as Triggr's app through [Microsoft Exchange](/integrations/microsoft-exchange), which needs Exchange.ManageAsApp and the Exchange Administrator role in each client's tenant. Repair grants both when Triggr's group has Privileged Role Administrator in the client's relationship; without it, [grant Exchange access yourself](/integrations/microsoft-exchange#grant-exchange-access-yourself).
## Check the connection
Triggr checks every linked client nightly. The client's GDAP Health card shows Microsoft sign-in, Graph permissions, Admin roles, GDAP relationship (with its end date) and Recent failures, and under Won't fully work here names each workflow missing a role, a permission or Exchange, with the fix. Click Check now to check one client (once a minute), or **Check all** on Clients (once every 10 minutes).
Repair (org admins only) lists what it will do, then grants or replaces Triggr's consent, sets up Exchange and checks again. It never changes GDAP relationships or roles, and runs at most once every six minutes per client.
To see relationship end dates, select **Expiring** on Clients. If the card says Triggr can't read GDAP end dates yet, click Sign in with Triggr's service account and sign in as that same account; anyone else changes the sign-in every client uses. For a weekly or daily summary, turn on [GDAP alerts](/core/manage/gdap-alerts).
GDAP Setup at the top of the integration page opens the GDAP Setup Wizard: **Start Setup for All Tenants** checks every client's link, both sign-ins, its Partner Center relationship and Triggr's access to its tenant, with fixes under View Remediations. For one client, click GDAP Setup on its row, then Start Setup Wizard.
## Troubleshooting
The client isn't linked (its GDAP Health card shows Not linked), and built-in Microsoft steps fail with `… integration is not configured for tenant ''`. [Link it](#link-each-client) or use Automap.
Click **Grant app consent** or Repair on the client's GDAP Health card. If that fails, check Microsoft CSP is authorised as the service account, the account is in AdminAgents, and Triggr's group has Cloud Application Administrator in the client's relationship. See [Microsoft CSP troubleshooting](/integrations/microsoft-graph/csp#troubleshooting).
Triggr's consent in the client is from an older permission set. Click Repair: it removes the consent and grants it again, so Triggr can't reach the client for a minute or so.
Add the named role to the client's GDAP relationship and assign it to Triggr's group in Partner Center (a relationship without it needs replacing). Once the assignment is Active, click Check now.
Check the relationship is Active in Partner Center (not Approval Pending), Triggr's group has an Active role assignment in it, the service account is in that group, and the client's TenantID in Triggr is its own.
Click **Renew** on the card, or turn on Auto Extend in Partner Center. An expired relationship can't be renewed: request a new one, assign Triggr's group its roles again, then click Check now.
A policy in the client's tenant blocked the service account (`AADSTS53003`). Exclude your partner tenant's service provider users from it. See [Conditional Access](/integrations/microsoft-graph/conditional-access#your-clients-tenants).
The service account's password changed, its sessions were revoked or a policy in your tenant now blocks it. Click Authorize on the Base Configuration card and sign in as the service account with MFA. Repair reports this as "Triggr's Microsoft sign-in for your organisation needs fixing first".
Your own app registration's client secret expired. Create a new secret in Microsoft Entra, click **Edit** on the Base Configuration card and paste its Value into ClientSecret.
Check the client's relationship is active and the service account is still in AdminAgents, then click Authorize on Microsoft CSP and retry.
The client's TenantID is your partner tenant's ID. Open its configuration in the Per-Client Configuration card and enter the client's own tenant ID. Automap refuses this too, as it does a tenant another client already uses.
Repair and automatic setup take a short lock per client. Wait a few minutes, then run Repair again. "Checked less than a minute ago" and "repaired a few minutes ago" are the rate limits above.
Admin consent hasn't been granted in your partner tenant. Click Admin Consent on the Base Configuration card and sign in as a Global Administrator, then click Authorize again.
The account you signed in with isn't an Admin agent, or isn't the service account. Sign in again as the service account, with it in AdminAgents.
Enter a domain verified in that tenant, such as its `.onmicrosoft.com` domain, or paste the tenant ID from Entra ID > Overview in that tenant.
More questions: see the [Microsoft and GDAP FAQ](/core/reference/microsoft-faq).
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.