> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Recommended roles

> The Microsoft Entra roles to give Triggr's security group in your clients' GDAP relationships, and what each one is for.

Triggr works in a client's tenant with the roles its GDAP relationship assigns to Triggr's security group. Give the group the least-privileged roles that cover your workflows: tick them when you [request the relationship](/integrations/microsoft-graph/gdap-service-account#request-a-gdap-relationship-with-each-client), as roles can't be added later, then [assign them to the group](/integrations/microsoft-graph/gdap-service-account#give-the-account-access-to-your-clients).

## Recommended set

For Triggr's built-in Microsoft 365 workflows, request and assign:

| Role | Used for |
| - | - |
| [User Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#user-administrator) | Creating, editing, enabling, disabling and deleting users, resetting passwords and revoking sessions (non-admins and limited admins), licences and group membership |
| [Authentication Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#authentication-administrator) | Resetting a non-admin user's MFA methods |
| [Cloud Application Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#cloud-application-administrator) | Granting Triggr's app consent through Partner Center (Grant app consent, Repair, Grant GDAP Consent). [Application Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#application-administrator) also works. |
| [Privileged Role Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#privileged-role-administrator) | Letting Repair give Triggr's app Exchange.ManageAsApp and the Exchange Administrator role, for mailbox steps |

Add [Privileged Authentication Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#privileged-authentication-administrator) if your workflows reset passwords or MFA, revoke sessions or delete users who hold an admin role.

Privileged Role Administrator can assign any role. Without it, [grant Exchange access yourself](/integrations/microsoft-exchange#grant-exchange-access-yourself) in each client's tenant. Mailbox steps always run as Triggr's app through [Microsoft Exchange](/integrations/microsoft-exchange), not with GDAP roles.

## Narrower alternatives

If you'd rather not give User Administrator, these cover parts of it:

| Role | Covers |
| - | - |
| [License Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#license-administrator) | Assigning and removing licences |
| [Groups Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#groups-administrator) | Creating and deleting groups and changing members |
| [Helpdesk Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#helpdesk-administrator) or [Password Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#password-administrator) | Resetting non-admin users' passwords (Helpdesk Administrator also revokes their sessions) |
| [Directory Writers](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#directory-writers) | Creating and editing users and groups, and licences, without deleting users |

## Roles for your own Microsoft Graph (GDAP) actions

| Actions | Role |
| - | - |
| Inviting guests | [Guest Inviter](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#guest-inviter) or User Administrator |
| Directory roles and role assignments | Privileged Role Administrator |
| Applications, service principals and app role assignments | Cloud Application Administrator or Application Administrator; Privileged Role Administrator to assign Microsoft Graph application permissions |
| Reading users, groups, licences, domains and directory roles | Any role above, [Directory Readers](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#directory-readers) or [Global Reader](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#global-reader) |

Global Administrator covers everything and satisfies every Triggr check, but Microsoft recommends least-privileged roles and won't auto-extend a relationship that includes it. See Microsoft's [GDAP role guidance](https://learn.microsoft.com/en-us/partner-center/customers/gdap-least-privileged-roles-by-task).

## Check a client's roles

The client's GDAP Health card shows whether Admin roles cover Triggr's built-in workflows, naming any gap as "Needs *Role* for *Workflow*" (for example "Needs User Administrator for Onboarding"), and lists which of the roles Triggr tracks (Global, User, Exchange, Privileged Authentication, License, Cloud Application, Groups and Intune Administrator) the relationship holds. After changing an assignment, wait until it's Active in Partner Center, then click **Check now**.

## Troubleshooting

<AccordionGroup>
  <Accordion title="A step fails with a permission error">
    Check the GDAP Health card for a missing role, and that Triggr's group has an Active assignment for it with the service account as a member. If the card reports Missing permissions instead, click **Repair**.
  </Accordion>

  <Accordion title="The role isn't in the client's relationship">
    Request a new GDAP relationship that includes it. Once the client approves, assign the role to Triggr's group in the new relationship.
  </Accordion>

  <Accordion title="The relationship has the role but the card still says Missing roles">
    Triggr reads roles from the service account's sign-in, so the role must be assigned to a group the account is in, not just included in the relationship. Add the assignment under **Security groups**, wait for Active, then click Check now.
  </Accordion>

  <Accordion title="Repair can't set up Exchange">
    Repair reports that Triggr's GDAP roles can't assign admin roles. Add Privileged Role Administrator to the relationship and Triggr's group, or [grant Exchange access yourself](/integrations/microsoft-exchange#grant-exchange-access-yourself).
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.