{"id":24169,"date":"2023-02-15T13:37:48","date_gmt":"2023-02-15T18:37:48","guid":{"rendered":"https:\/\/www.sherweb.com\/blog\/?p=24169"},"modified":"2024-06-26T17:57:18","modified_gmt":"2024-06-26T21:57:18","slug":"dap-to-gdap-transition","status":"publish","type":"post","link":"https:\/\/r-swca2-app15-sherwebblogprd-c5f5cbg9dbf0btgy.canadacentral-01.azurewebsites.net\/blog\/security\/dap-to-gdap-transition\/","title":{"rendered":"How to manage Microsoft\u2019s transition from DAP to GDAP"},"content":{"rendered":"

In alignment with its mission to implement a Zero Trust security model across its products, services and entire partner ecosystem, Microsoft is putting an end to delegated admin privileges (DAP) in favour of more secure granular delegated admin privileges (GDAP). Admin privileges are essentially security measures that detail accesses between Microsoft partners\u2014whether they\u2019re indirect providers, indirect resellers or direct bill partners\u2014and their clients. In other words, they affect how Microsoft partners interact with customer workloads in Microsoft 365<\/a>, Dynamics 365<\/a> and Microsoft Azure<\/a>. These changes therefore have an impact on any partners who transact in Microsoft\u2019s CSP program<\/a>.<\/p>\n

Beginning May 22, 2023, Microsoft will transition both active and inactive DAP relationships to GDAP ones with limited Azure Active Directory (AAD) roles. Once this transition takes place, Microsoft will then remove corresponding DAP relationships 30 days later. Relationships that have already been transitioned from DAP to GDAP by Microsoft partners prior to May will not be affected, however Microsoft will officially disable any remaining DAP access by the end of July.<\/p>\n

While increased security is undoubtedly a good thing, it\u2019s understandable that many partners and their clients have questions about the move from DAP to GDAP, how it will affect them and how to transition clients themselves prior to Microsoft taking action.<\/p>\n

What are granular delegated admin privileges (GDAP)?<\/h2>\n

Keeping with the Zero Trust principle of explicit verification and using least privileged access, GDAP<\/a> provides more explicit roles and time-bound parameters for partner access to customer environments than DAP. They restrict access to customer tenants on a deeper level, thereby reducing security risk between Microsoft partners and their clients. More specifically, GDAP details access at the customer, partner tenant, partner user and workload levels for different Microsoft services.<\/p>\n

The point of GDAP is ultimately to protect access to customer data. GDAP also helps partners accommodate clients with regulatory requirements to allow only least privileged access to providers.<\/p>\n

How does GDAP work?<\/h2>\n

Once enabled (which we\u2019ll cover in greater detail below), Microsoft partners can assign their users to different security groups and associated roles. These security groups are then given access to customer workloads for a fixed duration of time, up to a maximum of two years. Afterwards, the access automatically expires.<\/p>\n

Security groups are created in partner tenants using Azure Active Directory (AAD)<\/a>. Some examples of different admin privileges include:<\/p>\n