By Chris McDuffie, Structured VP of Cloud Architecture —

We all know someone with an unusual hobby. I read this week about a guy who spent the last 21 years recreating New York City in miniature by hand out of balsa wood. One of my more unique hobbies is Microsoft licensing.

Back in the ’80s and ’90s while at Microsoft, I thought nothing of formatting and reinstalling the OS and apps every 6 months or so. Didn’t everyone? It was a serious culture shock once I left and realized licenses weren’t free or highly discounted at the company store.

I learned about Server Provider Licensing Agreement (SPLA) while at an internet company. None of the reseller experts knew enough to guide us, so I had to figure things out for myself. We had tens of thousands of domain reseller partners and customers, so it was critical to get it right. Both for them and to avoid overspending while maintaining license compliance.

Fast forward to today and leading the Microsoft CSP program at Structured was a natural fit.

Microsoft EA Renewals and What’s Next

Microsoft programs and licensing are obtuse at best. That said, they are often in the top five budget items of any IT organization, drive productivity, may provide the first line of defense, and run numerous essential custom applications and workloads that thriving businesses need to create value and intellectual property. Microsoft is a strategic partner for most organizations.

So here’s why you should care about CSP.

• First, Microsoft is retiring EA renewals, particularly for Level A (≤ 2,400-seat) customers. They are pushing those organizations toward the Microsoft Customer Agreement (MCA or MCA-E) or CSP. It’s going to take 3-5 years due to the renewal cycle, but that’s their goal. EAs are a very manual process consisting of multiple agreements and steps that everyone dreads. Level A customers are all but forced to look for better options to support licensing questions, assessments, license compliance, and general advice.
  
• Second, what is the box that’s called CSP? How does it work, what’s behind the scenes, and are there any benefits or risks associated with it?

Microsoft CSPs and GDAP

With all that as background, today I’d like to peel back the covers on a partner administrative management platform that many orgs may not even be aware of: Granular Delegated Admin Privileges (GDAP).

Microsoft defines GDAP as: “[A] security feature that provides partners with least-privileged access following the Zero Trust cybersecurity protocol. It lets partners configure granular and time-bound access to their customers’ workloads in production and sandbox environments. Customers must explicitly grant the least-privileged access to their partners.”

Think of it as a Microsoft MSP management platform for Microsoft Online and Azure services. From the very beginning of the CSP program, Microsoft built the platform assuming that many (if not most) of their CSP customers would be managed. While that was true early on, it’s much less so today, especially with the expansion into larger and larger customers with the EA program’s dissolution.

GDAP is very much like a partner version of Privileged Identity Management, and is intended to adhere to the following principles:

• Granular
• Least privilege
• Time-bound with a maximum of 2 years
• Auto expiration, but can be set to auto renew every 6 months if appropriate
• Leverages security groups
• Requires explicit customer approval
• Note that Azure RBAC is a separate security management platform. Even if a CSP has a granular role in their client’s tenant, they do not necessarily have access to Azure resources without additional permission.

CSP engineers request access to client environments on an as-needed basis through GDAP.

• CSPs do not need the client to set up and maintain an account in their own directory. They use their secure, admin credentials within the partner tenant to access the client environment.
  • Note: Microsoft requires partner tenants to meet strict security requirements. All partner identities should be protected by MFA and governed by Conditional Access. Microsoft makes this a requirement for GDAP.
• The client can revoke the request at any time.
• The same logging and reporting used internally at the client can be used to monitor and report on the partner engineer using GDAP.

This all sounds awesome, and it really is. GDAP rolled out in early 2023 to replace the legacy program called DAP, or Delegated Admin Privileges. DAP provided CSPs full Global Admin access to client tenants without an expiration date. While that seemed like a good idea over 10 years ago when the program began, it doesn’t fit modern security practices and standards. This was brought to light in a very dramatic way through the SolarWinds attack a few years ago.

Clients of compromised CSPs were exposed to threats because they possessed highly privileged roles in their tenant. While the impact ultimately was lower than originally assessed, it was a big driver for addressing the potential security gap DAP created.

Critical CSP & GDAP Security Questions to Answer

Two things I want you to think about:

1. Do you still have a DAP relationship with your CSP? If yes, remove it. Microsoft’s end date for all DAP relationships is this month — July 2025.
2. What GDAP roles does your CSP currently have with you, and what is the timeout set for them?

For organizations that have outsourced O365 and Azure management to an MSP, they may have some roles, and those roles may auto extend. Some organizations may have support partners that require GDAP roles to facilitate troubleshooting.

Even so, it is important to regularly review what access your CSP has as part of your security best practices. Ask yourself the following:

1. What CSPs have roles in my environment?
2. Do I still do business with them?
3. What roles does my CSP have?
4. What is the purpose of those roles?
5. Are there any roles that can be limited to just in time (JIT) access?
6. Who at the partner has access to my tenant?
7. Am I properly tracking and reporting on my CSP’s activity in my tenant?
8. Do I have any regulatory requirements that may impact GDAP?
9. Where possible, have you layered Entra ID Privileged Identity Management on top of GDAP so Global Admin is activated just in time, with approval workflow and audit trail?

Final Thoughts

Take some time this week to review your GDAP partnerships and see if anything needs to be cleaned up to improve your overall security posture. You can find it at:

• admin.microsoft.com
• … Show all
• Settings
• Partner relationships
  • Approved requests
  • Pending requests

If you need further help in deciphering Microsoft licensing, regulatory compliance, or strengthening your security posture, we’re here to help. Happy Thursday!

Are you a Level A customer with Microsoft? Need a reputable CSP? Contact your account manager or email @info@structured.com today.

About the Author

Chris McDuffie is an IT-industry veteran with more than 35 years’ experience, including 24 years managing both enterprise infrastructure and the teams supporting it. As a consultant and strategist, he aligns business needs, budget, architecture and industry best practices to maximize positive outcomes for business. With each engagement, his significant experience with Microsoft, application delivery, secure remote work, IAM, SASE and cloud security puts clients on a much stronger footing to tackle IT problems and seize growth opportunities.