GDAP

This needs CSP enrollment and active GDAP relationships. Once a tenant is connected, Neo works in it through its own app, with app-only access, the same as with Direct Consent.

​

What it takes

A few clicks in Integrations → GDAP: sign in, have a Global Administrator approve Neo, and click Connect all eligible. The run continues in the background, and you do not need to stay on the page. A company is eligible once it is mapped to a tenant that Neo can reach through CSP, and your account’s group has Privileged Role Administrator (or an alternative the role table lists) on that relationship. A client you add later gets a Connect via GDAP button on its row once it is eligible. Your relationships need a role for each of the two jobs in Roles your relationships need, assigned to the group of the account you sign in with.

​

Connecting customer tenants via GDAP

The Integrations → GDAP page shows these steps as a checklist. If several PSA companies map to the same Microsoft tenant, connecting one connects them all, because Neo’s access belongs to the tenant. A client that owns two Microsoft tenants needs one company per tenant: see Customers with more than one Microsoft tenant.

---

​

Roles your relationships need

Neo acts in each customer tenant through its own app, with the Microsoft Graph permissions in your M365 permission profile. It uses relationship roles only to set that app up. Each relationship needs a role for each of these two jobs: Neo assigns Exchange Administrator to its own app, because app-only Exchange access needs it, unless you turn off Auto-assign Exchange Administrator role on consent for the company. Your account’s group does not need that role. Global Administrator covers both jobs, but a relationship with it cannot auto-extend (see the suggested role set below). The account you sign in with must be in a security group that has a role for both jobs on each relationship. A role on the relationship is not enough if your group’s access assignment does not include it. This is the most common reason a client will not connect. The checklist flags a company whose group lacks Privileged Role Administrator (or an alternative) or has no access assignment there. It does not check Application Administrator (or an alternative): without one, the client fails only when Neo connects it, with the 403 Forbidden above. Fix the access assignment in Microsoft Lighthouse or Partner Center. For Lighthouse-managed relationships (LHSetup, MLT_), do not edit them in Entra, because Lighthouse reverts manual changes.

Creating a new relationship? Suggested full role set

A GDAP relationship cannot be edited after you create it, so include every role you may need. Beyond Application Administrator and Privileged Role Administrator, these cover the work MSPs most often give Neo:

Role	What it covers
Exchange Administrator	Mailboxes, forwarding and delegation
User Administrator	Users and groups; password resets for non-admins
Privileged Authentication Administrator	Password, MFA and session resets for admins too. Neo gets this role only for a company where you turn on Auto-assign Privileged Authentication Administrator role (off by default)
Authentication Policy Administrator	Authentication methods policy and MFA settings
Security Administrator	Security reports, identity protection and threat management
Cloud App Security Administrator	Defender for Cloud Apps
Cloud Device Administrator	Entra devices and BitLocker keys
Intune Administrator	Intune policies and devices
SharePoint Administrator	SharePoint Online and Microsoft 365 groups
Teams Administrator	Microsoft Teams

Leave Global Administrator out. A relationship with it cannot auto-extend, so it expires and takes your access with it.Extra roles do not widen Neo’s access by themselves: Neo’s app can do only what your permission profile grants.

---

​

Moving a direct-consent company to GDAP

A company connected by direct consent can move to GDAP at any time. Neo keeps its access throughout, and no client admin consents again. On the Companies page, open ⋯ → Move to GDAP on the company’s row, or use Move to GDAP (N) in the banner to move all eligible companies. Progress shows in the provisioning-run panel, and M365 Access then shows “via GDAP”. After the move, the company’s permissions come from your GDAP permissions selection.

---

​

Disconnecting a company

On End Companies, select the company and click Disconnect. Neo removes the Neo Azure Automations app from the customer tenant. Every other company on the same tenant loses access too. Disconnecting needs an active GDAP relationship. If it has lapsed, reconnect GDAP first, or have an admin remove the Neo Azure Automations app in the tenant.

​

Disconnecting GDAP entirely

In Integrations → GDAP, click Disconnect GDAP. Neo stops using your relationships, for example before you switch the connected account.

---

​

When a GDAP relationship lapses

A relationship lasts at most 730 days. When it lapses, connected tenants keep working, but you cannot connect new clients or add permissions. Create a new relationship in Partner Center with the same roles, then reconnect GDAP in the Neo Dashboard. To remove Neo from a tenant, disconnect the company while a relationship is still active.

---

​

GDAP vs Direct Consent

The choice is not permanent: see Moving a direct-consent company to GDAP.

---

​

Troubleshooting