Role Assignment and GDAP Configuration

Role assignment for GDAP requests

The following table outlines the roles that SoftwareOne may require to establish a granular admin relationship request. It also describes what each role enables.

Service - Microsoft Azure

Role name	Description
Directory reader​	Can read basic directory information.
Global reader	Can read everything that a Global Administrator can, but cannot update anything.
Service support administrator​	Can read service health information and manage support tickets.
Billing administrator	Performs common billing-related tasks, like updating payment information.

Service - Microsoft 365 Business, Enterprise, & Apps (Charity, Commercial, and Education)

Role name	Description
Attack simulation administrator	Can create and manage all aspects of attack simulation campaigns.
Authentication administrator​	Can access to view, set and reset authentication method information for any non-admin user.
Billing administrator	Performs common billing-related tasks like updating payment information.
Compliance administrator	Can read and manage compliance configuration and reports in Microsoft Entra ID and Microsoft 365.
Directory readers ​	Can read basic directory information. Commonly used to grant directory read access to applications and guests.
Domain name administrator ​	Manages domain names in cloud and on-premises.
Exchange administrator ​	Manages all aspects of the Exchange product.
Global reader ​	Can read everything that a Global Administrator can, but not update anything.
Groups administrator ​	Can create and manage groups, create and manage group settings like naming and expiration policies. Can also view group activity and audit reports.
Hybrid identity administrator ​	Manages Active Directory to Microsoft Entra cloud provisioning, Microsoft Entra Connect, pass-through authentication (PTA), password hash synchronization (PHS), seamless single sign-on (seamless SSO), and federation settings. Does not have access to manage Microsoft Entra Connect Health.
Intune administrator ​	Manages all aspects of the Intune product.
License administrator	Manages product licenses on users and groups.
Network administrator	Manages network locations and reviews enterprise network design insights for Microsoft 365 Software as a Service applications.
Fabric administrator (PowerBI) ​	Manages all aspects of the Fabric and Power BI products.
Power platform administrator	Can create and manage all aspects of Microsoft Dynamics 365, Power Apps and Power Automate.
Security administrator ​	Can read security information and reports, and manage configuration in Microsoft Entra ID and Office 365.
Service support administrator ​	Can read service health information and manage support tickets.
SharePoint administrator ​	Manages all aspects of the SharePoint service.
Skype for business administrator	Manages all aspects of the Skype for Business product.
Teams administrator	Manages the Microsoft Teams service.
User administrator	Manages all aspects of users and groups, including resetting passwords for limited admins.
Windows 365 administrator	Can create and manage security groups but does not have administrator rights over Microsoft 365 groups.
Cloud application administrator	Grants the ability to create and manage all aspects of enterprise applications and application registrations.

Service - Microsoft Dynamics 365 (Charity, Commercial, and Education)

Role name	Description
Authentication administrator​	Can access to view, set and reset authentication method information for any non-admin user.
Billing administrator	Performs common billing-related tasks like updating payment information.
Directory readers ​	Can read basic directory information. Commonly used to grant directory read access to applications and guests.
Global reader	Can read everything that a Global Administrator can, but not update anything.
Groups administrator ​	Creates and manages groups and creates and manages group settings like naming and expiration policies. Can also view group activity and audit reports.
License administrator	Manages product licenses on users and groups.
Fabric administrator (PowerBI) ​	Manages all aspects of the Fabric and Power BI products.
Power platform administrator​	Can create and manage all aspects of Microsoft Dynamics 365, Power Apps and Power Automate.
Service support administrator ​	Can read service health information and manage support tickets.
User administrator	Manages all aspects of users and groups, including resetting passwords for limited admins.
Cloud application administrator	Grants the ability to create and manage all aspects of enterprise applications and application registrations.

Configuration

The GDAP admin relationship is established with the following configuration:

Property	Value
displayName	Microsoft Tenant Name + 'admin relationship'
duration	P2Y
autoExtendDuration	180 days

Once the GDAP relationship is in place, its duration is set to 2 years by default. When the relationship is about to expire, it's automatically extended for an additional 180 days.