Resource Guide

Can Your IT Provider Access Your Microsoft 365?

Name: Titan IT Management LLC
Address: 900 SE Ocean Blvd, Suite 130D, Stuart, FL, 34994, US
Telephone: 772-279-6180
Price range: $$

Your IT provider can be the weakest link in your Microsoft 365 security, even when every employee uses MFA. Many owners on the Treasure Coast assume the tenant they log into every day is theirs alone. Then they learn that the IT company they hired in Stuart can administer it through a partner relationship they approved once and never looked at again. If that provider's admin accounts or automation apps are abused, an attacker can move into your tenant without phishing every staff mailbox.

See the two access paths Check my Microsoft 365

In the Microsoft 365 admin center, go to Settings, then Partner relationships. The list shows each partner, the relationship type, and the admin roles they hold, including older DAP Global Administrator access or newer time-bound GDAP roles. You can remove those roles without ending a reseller billing relationship. A Global Administrator should review this list on a regular schedule.

This article is general information, not legal advice. It is not a claim that any named local provider has been breached.

Reviewed by Rich Timmons, Founder and CEO. Last reviewed: November 5, 2026.

Partner Relationships

How do I check which Microsoft partners can administer my Microsoft 365?

You can look this up yourself. You do not have to wait for your provider to run a report. A Martin County or St. Lucie County office can do it from any browser.

1Sign in to the Microsoft 365 admin center with an admin account.
2Open Settings, then Partner relationships.
3Read each partner name, the relationship type, and the admin roles listed. You may see an older reseller or DAP-style relationship, or a newer label such as "Partner with GDAP access."
4Open a partner you do not recognize, or one whose roles look broader than day-to-day support, and write down the name, type, and roles.

Microsoft documents these steps in Microsoft Learn. You can remove a partner's admin roles without ending the partner relationship. The partner may still sell you licenses as a reseller. Cutting admin access is not the same as canceling billing. See Microsoft's partner-privileges article.

You need an admin role Microsoft names for the task. The partner-relationships article says you must be at least a Billing Administrator to use that page. Approving a new GDAP request takes a Global Administrator. If you cannot get into the admin center, ask who owns the admin accounts. Microsoft also documents delegated administration in Microsoft Entra ID and points customers from the Delegated administration page to the Partners page. See Delegated administration in Microsoft Entra ID.

DAP and GDAP

What DAP and GDAP actually are

Two models show up on that list.

DAP (Delegated Admin Privileges) is the older model. Microsoft says it lets a Cloud Solution Provider (CSP) delegate Global Administrator and Helpdesk Administrator roles, and that the relationship persists until the customer or the CSP revokes it. Microsoft warns that giving DAP, which includes Global Administrator permissions, to any partner presents a security risk, and recommends a quarterly review of those privileges. That is Microsoft's recommendation, not a legal requirement.

GDAP (Granular Delegated Admin Privileges) is the newer model. Microsoft describes it as least-privileged, time-bound partner access that the customer must explicitly grant. A GDAP request states the partner tenant, the Microsoft Entra roles, and an expiration date, and a Global Administrator must approve it. See GDAP introduction.

Microsoft's GDAP FAQ says permanent GDAP relationships are not possible, the maximum duration is two years, auto-extend can add six months at a time until that setting is disabled or the relationship is terminated, and relationship requests expire after 90 days if the customer does not act. An admin relationship that includes the Global Administrator role cannot be auto-extended.

While DAP and GDAP coexist, Microsoft says GDAP permissions take precedence over DAP for Microsoft 365, Dynamics 365, and Azure workloads, and that GDAP is replacing DAP. Microsoft can also run a Microsoft-led transition that creates a one-year GDAP relationship with a default role set and removes DAP 30 days later. See the Microsoft-led DAP to GDAP transition. That is Microsoft's process, not a claim about every tenant you will see.

Access model	Who has to approve it	Typical privilege	Does it expire by itself	Where you review it
DAP	The older model persists until you or the CSP revokes it	Microsoft says DAP delegates Global Administrator and Helpdesk Administrator	No. It lasts until revoked	Settings, then Partner relationships
GDAP	A Global Administrator in your tenant must approve a request that names the partner, the roles, and an expiration date	Specific Microsoft Entra roles you approve	Yes. Permanent GDAP is not possible. Maximum duration is two years. Auto-extend can add six months at a time until disabled or terminated	Settings, then Partner relationships

Two Access Paths

How a provider (or an attacker using the provider) reaches a client tenant

There are two related paths. They are not the same move.

Partner admin access (DAP or GDAP)

In 2021 Microsoft warned that NOBELIUM (the actor Microsoft also associates with the 2020 SolarWinds compromise) targeted CSPs, MSPs, and other IT service providers with administrative or privileged access, then tried to reach their customers. Microsoft said these attacks were not caused by a product security vulnerability. Techniques included password sprays, token theft, API abuse, and spear phishing, and vectors included DAP. See Microsoft's October 25, 2021 Security Blog post.

On October 24, 2021, Microsoft said it had notified more than 140 resellers and technology service providers targeted since May 2021, and that it believed as many as 14 of them had been compromised. Those are Microsoft's 2021 figures, not a current industry rate. See Microsoft On the Issues. Microsoft also noted that delegated privileges are often left in place after they are no longer needed, and told downstream customers to review and minimize partner permissions, remove unfamiliar relationships, use strong authentication, and review Microsoft Entra sign-in logs filtered for service-provider (cross-tenant) access.

Entra apps, service principals, and added secrets

An app registration creates an identity for software. The service principal is how that app appears in a tenant. A client secret is a string the app can use like a password (Microsoft also calls this an application password). Microsoft says client secrets are less secure than certificates or federated credentials and should not be used in production, and that the secret value is shown only once. See Microsoft's app credentials guidance.

If someone with enough directory privilege adds a new secret or certificate to an existing app, they can authenticate as that app without signing in as a person. That is app-secret abuse. Consent abuse is the related move: tricking a user or using admin rights to grant an app broad permissions.

Microsoft's January 2024 Midnight Blizzard write-up (the same actor also known as NOBELIUM) is specific, so we do not add claims Microsoft did not make. Microsoft detected a nation-state attack on January 12, 2024. Initial access was a password spray against a legacy, non-production test tenant account that did not have MFA. The actor compromised a legacy test OAuth application with elevated access, created additional malicious OAuth applications, created a new user account to grant consent to those apps, and used that app to grant the Office 365 Exchange Online full_access_as_app role, which allows access to mailboxes. See the Midnight Blizzard responder guidance. That article also flags OAuth apps that increase Exchange access after certificates or secrets are updated or new credentials are added. The 2021 NOBELIUM partner article lists creation of additional service principal credentials among later directory changes.

A secret or certificate on an over-privileged app can keep working after you reset a person's password. Review Enterprise applications and recent credential changes next to Partner relationships.

What You Might Notice

What GDAP or delegated-admin abuse can look like from your seat

Many of these clues also have innocent explanations, such as a technician fixing mail flow or a licensing change. Notice them, then ask. This is not a self-diagnosis flowchart.

A partner name you do not recognize, or more than one partner, under Settings, then Partner relationships
Roles that say Global Administrator on an older DAP relationship
GDAP roles that look broader than day-to-day support (ask the provider to explain each role in plain English)
New enterprise applications or OAuth consents nobody on staff requested
New client secrets or certificates on apps that already existed
Mailbox access, forwarding, or impersonation permissions granted to an app (full_access_as_app or ApplicationImpersonation are terms Microsoft uses in the Midnight Blizzard guidance)
Sign-ins listed as a service provider or partner rather than as an employee (Microsoft's 2021 guidance: filter Microsoft Entra sign-in logs for cross-tenant access type "Service provider")
Admin actions you did not request: password resets, new admin users, MFA method changes, or domain changes
A technician who cannot explain which named people at the MSP can reach the tenant, or who shares one admin login

What staff often will not see: an attacker using app-only permissions may not appear as "Bob from the help desk signed in."

Questions to Ask

Questions to ask your IT provider

Use this list in writing.

Which partner relationships exist in our Microsoft 365 tenant, and which company owns each one? You cannot oversee what you cannot name.
Do you still have legacy DAP (Global Administrator) access, or only GDAP? DAP is standing Global Administrator access until someone revokes it.
If you use GDAP, which exact Microsoft Entra roles did we approve, and when does the relationship expire? Ask for the role names and the end date.
Have you removed DAP after moving us to GDAP? The older path can remain after a newer one is added.
Which named people at your company can administer our tenant, and do they use separate admin accounts with MFA (ideally phishing-resistant MFA)? Shared logins make it hard to know who did what.
Do any of your tools sign in as an app? If yes, which apps, which permissions, and how are those credentials stored and rotated?
Do you alert us (or yourselves, with a record we can see) when a new partner relationship, GDAP role, enterprise app, or app secret appears?
How often do you review partner access and unused admin privilege with us?
If your company were compromised, what is the first call we get, and how would you cut your own access?
Will you walk through Partner relationships and Enterprise applications with us?

The May 11, 2022 joint advisory AA22-131A (CISA, NSA, FBI, and international partners) tells MSPs and customers to disable unused accounts, enforce MFA on MSP accounts that access the customer environment, monitor unexplained failed authentication, and make sure contracts spell out who owns which security responsibilities. See CISA advisory AA22-131A.

Microsoft requires partners to enforce MFA for user accounts in the partner tenant for Partner Center and related admin paths, and tells partners to use GDAP for delegated administration. See Microsoft's partner MFA requirements. That is a Microsoft partner requirement, not proof that every local MSP follows it well.

Why It Matters More in Some Offices

Why this hits legal, construction, schools, and nonprofits harder

Law firms

Client confidentiality is not only an IT preference. Florida Bar Rule 4-1.6 addresses confidentiality of information. Florida Bar guidance on Rule 4-1.6(e) says lawyers must act competently to safeguard client information against unauthorized access or disclosure, and that compliance is measured by reasonable efforts under the circumstances. That is professional-conduct guidance, not a substitute for ethics advice from the firm and its counsel.

An MSP with standing Global Administrator rights, or an over-privileged app, can read mail and files the same way a firm administrator could. Reasonable efforts include knowing which vendors have that reach and how they are limited. Titan's notes for law firms start from that oversight question.

Construction

Payment and wire fraud travel through email as often as they travel through a job trailer. A partner-path mailbox compromise can change invoice or draw instructions the same way a phishing-led case of business email compromise does. The difference is the starting point: the trust path may already sit with the IT provider. See Titan's construction page for how we talk through payments and day-to-day systems with builders and trades.

Schools (private, charter, and faith-based)

Student data and family communications live in Microsoft 365 for many campuses. A partner identity with broad roles can reach more than a single teacher's mailbox. That is the concern for private, charter, and faith-based schools, including the campuses we support. Titan's schools page is written for that setting, not for public-district procurement.

Nonprofits

Donor lists, grant files, and board email are often concentrated in the same tenant. A partner or app with mailbox-wide permission can export that data quietly. Titan's nonprofit notes focus on keeping that information usable for staff and harder for an outsider to walk away with.

How Titan Approaches This

What Titan does differently

Titan IT Management is a local, family-owned firm and a Microsoft Cloud Solution Provider (CSP). We use GDAP for delegated admin access to client tenants. We use Microsoft's default GDAP roles and do not request Global Administrator in client tenants. That default set includes highly privileged roles, so it is not the smallest permission set Microsoft offers, and we do not describe those roles as minimal.

Our practice is to remove legacy DAP when we take over a client relationship. That describes a takeover. It is not a claim that every tenant is already off DAP.

Titan technicians sign in with phishing-resistant MFA and use separate admin accounts, not their daily email accounts. They get admin rights only when needed, through just-in-time access. We alert on partner sign-ins, new apps, and new secrets, and we review admin access with clients on a regular basis.

Our Microsoft 365 security assessments walk clients through their Partner relationships list. We also offer vulnerability scanning and penetration testing as part of broader cybersecurity work.

For emergencies, Titan keeps a break-glass Global Administrator account in Titan's own Microsoft partner tenant. It uses a long, unique password and a passkey. That account is Global Admin of Titan's partner tenant. It is separate from GDAP access in client tenants and does not grant Global Administrator there.

Microsoft says a GDAP relationship can auto-extend by six months at a time until that setting is disabled or the relationship is terminated. Titan's GDAP relationships use auto-extend by default. That keeps partner access in place when the term rolls forward, so review Partner relationships periodically. It is not a least-privilege selling point.

None of this makes compromise impossible, and we do not claim to be "the most secure MSP." These are the practices we use so you can see how access is supposed to work.

This Week

What to do this week

Open Settings, then Partner relationships, and screenshot the list.
Ask your provider the questions above, in writing.
Review Enterprise applications for names nobody recognizes.
Confirm MFA on every admin path you control, and ask the provider to confirm MFA on theirs. Why MFA is important covers the staff side of that conversation.
If you cannot get a clear answer, schedule a Microsoft 365 security assessment or call 772-279-6180.

Common Questions

Common questions about IT provider access to Microsoft 365

Can my IT company read email in my Microsoft 365 tenant?+

If you granted the company delegated admin roles, or if an app they control has mailbox permissions such as full_access_as_app, then yes, someone with that access can reach mail the same way a tenant administrator could. Review Partner relationships, and use GDAP so the roles you grant can be narrower and time-bound.

What is the difference between DAP and GDAP?+

DAP is the older model. Microsoft says it delegates Global Administrator and Helpdesk Administrator access and lasts until you or the partner revoke it. GDAP is the newer model: you approve specific Microsoft Entra roles for a set period, up to two years. Microsoft says GDAP takes precedence where both exist and that GDAP is replacing DAP.

If I remove my provider's admin roles, do I lose my Microsoft 365 licenses?+

Microsoft says removing a partner's admin roles does not remove the partner relationship. They may still work with you as a reseller. Talk with the partner before you cut access they use for daily support, and keep at least two admins you control so you are not locked out.

What is an Entra client secret, and why should an owner care?+

Microsoft describes a client secret as a string an app can use, in place of a certificate, to identify itself (an application password). If a privileged person adds a new secret to an app with broad permissions, the app can keep signing in even after a human password reset. Unused apps and extra secrets are worth reviewing.

How often should we review partner access?+

Microsoft recommends a quarterly review of DAP assigned to a reseller partner. GDAP relationships also expire and can auto-extend by six months unless that setting is disabled, so owners should know the end date and who can approve a renewal. CISA separately urges customers and MSPs to agree in writing who owns which security tasks.

See who can administer your Microsoft 365.

If you want a second set of eyes on Partner relationships and Enterprise applications, start with a Microsoft 365 security assessment. Titan IT Management serves businesses across the Treasure Coast. We will walk through the tenant with you, explain what we find in plain English, and leave you with a clear next step. Office hours are Monday to Friday, 8 AM to 5 PM.

Schedule a Microsoft 365 Security Assessment Call 772-279-6180 Where we work

Rules Regulating The Florida Bar, including Rule 4-1.6 (Confidentiality of Information)

Starting point for the current Rules; 4-1.6(e) guidance was also described in Florida Bar News (June 24, 2026).

View source