Skip to main content
Triggr works in a client’s tenant with the roles its GDAP relationship assigns to Triggr’s security group. Give the group the least-privileged roles that cover your workflows: tick them when you request the relationship, as roles can’t be added later, then assign them to the group. For Triggr’s built-in Microsoft 365 workflows, request and assign: Add Privileged Authentication Administrator if your workflows reset passwords or MFA, revoke sessions or delete users who hold an admin role. Privileged Role Administrator can assign any role. Without it, grant Exchange access yourself in each client’s tenant. Mailbox steps always run as Triggr’s app through Microsoft Exchange, not with GDAP roles.

​
Narrower alternatives

If you’d rather not give User Administrator, these cover parts of it:

​
Roles for your own Microsoft Graph (GDAP) actions

Global Administrator covers everything and satisfies every Triggr check, but Microsoft recommends least-privileged roles and won’t auto-extend a relationship that includes it. See Microsoft’s GDAP role guidance.

​
Check a client’s roles

The client’s GDAP Health card shows whether Admin roles cover Triggr’s built-in workflows, naming any gap as “Needs Role for Workflow” (for example “Needs User Administrator for Onboarding”), and lists which of the roles Triggr tracks (Global, User, Exchange, Privileged Authentication, License, Cloud Application, Groups and Intune Administrator) the relationship holds. After changing an assignment, wait until it’s Active in Partner Center, then click Check now.

​
Troubleshooting

Check the GDAP Health card for a missing role, and that Triggr’s group has an Active assignment for it with the service account as a member. If the card reports Missing permissions instead, click Repair.
Request a new GDAP relationship that includes it. Once the client approves, assign the role to Triggr’s group in the new relationship.
Triggr reads roles from the service account’s sign-in, so the role must be assigned to a group the account is in, not just included in the relationship. Add the assignment under Security groups, wait for Active, then click Check now.
Repair reports that Triggr’s GDAP roles can’t assign admin roles. Add Privileged Role Administrator to the relationship and Triggr’s group, or grant Exchange access yourself.