> ## Documentation Index
> Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploying the MSP Process Authenticator app to M365 Tenants through the Microsoft Partner Center

> IntroductionMicrosoft's Authenticator app is a great tool to use when verifying someone's identity through the MSP Process platform - it's more secure than…

### Introduction

Microsoft's Authenticator app is a great tool to use when verifying someone's identity through the MSP Process platform - it's more secure than just sending an SMS message, it can leverage additional biometric security mechanisms like Apple's FaceID, and it's convenient - your end-users likely already have the Microsoft Authenticator app on their phone.

In order for the MSP Process platform to send a push notification to your end-users, there are configuration steps that must be taken within that end-user's M365 tenant. This KB article will guide you through using GDAP Relationships in your CSP-model M365 tenant to complete those steps.

### Prerequisites

1. You must have the credentials for a user account in your CSP-model M365 tenant that is:
2. a member of the **AdminAgents** group in your CSP-model M365 tenant
3. Granted the **Assists your customers as -> Admin agent** permission in the Microsoft Partner Center:

### 1. Adding Groups to Microsoft Entra

You need to create three new Groups in Microsoft Entra - we suggest calling them **GDAP - Application Administrator, GDAP - Privileged Role Administrator** and **GDAP - User Administrator** - *and then associate that user account mentioned in the Prerequisites section to those three Groups.*

1. Login to the Microsoft Entra Admin Center ([https://entra.microsoft.com/](https://entra.microsoft.com/))
2. Navigate to **Groups -> All Groups**
3. Click the **New Group** Button
4. Fill in the Group details as outlined below:
5. Group Name: **GDAP - Application Administrator**
6. Microsoft Entra roles can be assigned to the group: **Yes**
7. Click the **No Members Selected** link, and select the user account mentioned in the Prerequisites section

5) Click **Create**
6) Repeat steps 3 and 4 for the **GDAP - Privileged Role Administrator** and **GDAP - User Administrator** group.

###

### 2. Requesting an Admin Relationship

For each M365 child tenant that you want to deploy the Microsoft Authenticator module into, you are required to create an Admin relationship from the Admin Relationships page in Partner Center.

1. The **GDAP - Application Administrator Group** would get assigned the **Application Administrator** Entra Role

2. The **GDAP - Priviledged Role Administrator Group** would get assigned the **Privileged Role Administrator** Entra Role

3. The **GDAP - User Administrator Group** would get assigned the **User Administrator** Entra Role

4. Login to the Microsoft Partner Center ([https://partner.microsoft.com/](https://partner.microsoft.com/))

5. Click on the **Customers** card

6. In the menu structure on the left, click on the **Administer** menu item

7. Click the **Request Admin Relationship** button

8. Request a relationship that includes the **Application Administrator, Privileged Role Administrator** and **User Administrator** Entra Roles

![](https://mintcdn.com/triggr/qgn0c5cLkGKqcauq/images/msp-process-kb/9a9282cf2c32.webp?fit=max\&auto=format\&n=qgn0c5cLkGKqcauq\&q=85\&s=ef6d4fa0e139784a828f197e6c2d79e7)

6. Enable the **Auto Extend** option
7. Click **Finalize Request** to complete the Admin Relationship request

### 3. Associating Entra Roles with the Correct Group

Now that an Admin Relationship has been created between your CSP M365 tenant and your client's M65 tenant, you must create an association between the Group created earlier in Entra and the Entra Roles specified in the Admin Relationship.

1. Login to the Microsoft Partner Center ([https://partner.microsoft.com/](https://partner.microsoft.com/))
2. Click on the **Customers** card
3. In the menu structure on the left, click on the **Administer** menu item
4. Click into the client's M365 tenant
5. Click into the Admin Relationship created in the last section
6. Click the **+Add Security Groups** button
7. Choose the *GDAP - Application Administrator* group

8) Choose the *Application Administrator Entra* role

9. Click **Save**
10. Repeat steps 6 thru 8 for the ***GDAP - User Administrator*** group and ***User Administrator*** Entra role
11. Repeat steps 6 thru 8 for the ***GDAP - Privileged Role Administrator*** group and ***Privileged Role Administrator*** Entra role

###

### 4. Obtaining the Redirect URI for the App Registration

You'll be creating an App Registration in your CSP-model M365 tenant; as part of configuring that App Registration, you'll need a Redirect URI - let's grab that from MSP Process:

1. Login to the MSP Process UI ([https://app.mspprocess.com](https://app.mspprocess.com))
2. Navigate to **Settings ->** **Integrations -> Security Integrations**
3. Click the **Add New Integration** button

4) Click on **Microsoft Authenticator**

\*\*

\*\*

5. Click the **CSP-model M365 Tenant** button

6) In the pop-up window that appears, click on the *copy* icon for the **Link for Redirect URI** parameter:

7. Leave the MSP Process window open; we'll be coming back to it in just a few minutes.

###

### 5. Configuring the App Registration in your CSP-model M365 Tenant

1. Login to your Microsoft Azure portal ([https://portal.azure.com](https://portal.azure.com/))
2. Navigate to **App Registrations**
3. Add a new App Registration, and configure it as follows (note that the URL will change, depending on the ID of your M365 integration):
4. **Name:** MSP Process Authenticator App (GDAP)
5. **Supported Account Types:** Multiple Entra ID tenants; choose the *Allow all tenants* radio button
6. **Redirect URI:** Web; URI: *\<enter the URI you just copied from MSP Process>*

![](https://mintcdn.com/triggr/-njaXAnAb5AWpJCy/images/msp-process-kb/6a4bb7b665a4.webp?fit=max\&auto=format\&n=-njaXAnAb5AWpJCy\&q=85\&s=64db8e84ab1b70ddc74a703c2fbe6232)

4. Click **Register** when you're ready.

###

### 6. Adding Permissions to the App Registration

You're going to be adding **7** permissions to the App Registration

1. 6 from the Microsoft Graph API
2. 1 for the Microsoft Partner Center

#### Microsoft Graph

| Permission | Type | Why it's needed |
| - | - | - |
| **Application.ReadWrite.All** | Delegated | Creates and configures the application/enterprise-app objects in your customer's tenant — registering the app, setting its required resource access, redirect URIs, and other properties as part of provisioning. |
| **AppRoleAssignment.ReadWrite.All** | Delegated | Grants (consents) the API permissions the deployed app needs by assigning app roles to its service principal, acting as the signed-in administrator. |
| **AppRoleAssignment.ReadWrite.All** | Application | The same capability as the Delegated-type *AppRoleAssignment.ReadWrite.All* permission, but running **unattended** (background/daemon), so the deployment can assign app roles without an interactive admin present. |
| **DelegatedAdminRelationship.Read.All** | Application | Reads your Granular Delegated Admin (GDAP) relationships with customers, so the tool can discover which customer tenants it's authorized to operate in and with what roles. This is what makes the multi-tenant rollout possible. |
| **DelegatedPermissionGrant.Read.All** | Delegated | Reads existing OAuth2 delegated permission grants so the tool can check what's already consented before writing changes — avoiding duplicate grants and keeping runs idempotent. |
| **Directory.ReadWrite.All** | Delegated | Writes the actual configuration into your customer's directory — creating/assigning the enterprise application and service principal, and configuring the objects needed for Authenticator. |

#### Microsoft Partner Center

| Permission | Type | Why it's needed |
| - | - | - |
| **user\_impersonation** | Delegated | Calls the Partner Center API on behalf of the signed-in partner user to enumerate customers and drive the CSP/partner-side operations. This is the standard Partner Center access scope. |

When you're done, the permissions **API permissions** page will look like this:

####

#### Adding the Application-level Permission

You're going to do the following steps twice - once for the **AppRoleAssignment.ReadWrite.All** permission, and then a second time for the **DelegatedAdminRelationship.Read.All** permission.

1. Within the App Registration, go to **Manage -> API permissions**
2. Remove the ‘User.Read’ permission
3. Click the **Add a permission** button
4. Click **Microsoft Graph** > **Application Permissions**

\*\*

\*\*

\*\*

\*\*

5. Search for **DelegatedAdminRelationship.Read.All**, and put a checkmark beside it

\*\*

\*\*

6. Click the **Add Permissions** button

#### Adding the Delegated-level Permissions

You'll complete the steps in this section **4 times** - once for each of the following permissions:

1. \- Application.ReadWrite.All

2. \- AppRoleAssignment.ReadWrite.All

3. \- DelegatedPermissionGrant.Read.All

4. \- Directory.ReadWrite.All

5. Click the **Add a permission** button

6. Click **Microsoft Graph** > **Delegated Permissions**

7. Search for **Application.ReadWrite.All**, and put a checkmark beside it

1) Click the **Add Permissions** button

#### Adding the Partner Center Permission

Finally, let's add the Partner Center permission that is needed

1. Click the **Add a permission** button
2. Go to the **APIs my organization uses** tab

3) Search for *fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd* (this is the ApplicationID of the required permission)
4) Click on the resulting **Microsoft Partner Center** entry
5) Put a checkmark beside the **user\_impersonation** permission

6. Click the **Add Permissions** button
7. Granting Admin Consent by click the **Grant Admin Consent** button

### 7. Creating a Client Secret & Providing the App Registration Information to MSP Process

1. Within the App Registration, navigate to **Manage -> Certificates & Secrets**, and add a new Client Secret.

2) Copy the **Value** (**not** the Secret ID), as you'll need it in just a moment

3. Back in MSP Process, fill in the rest of the fields in that Connect to Microsoft 365 (GDAP) pop-up window:
4. The **Domain Name** of your M365 CSP tenant (this is the Primary Domain that you'd see on the Home page, in Microsoft Entra)
5. The **Application ID** of the app you just registered; this can be found on the Overview page of the App Registration
6. The **Client Secret** from step #17

4) Click **Submit**
5) In the Microsoft window that appears, sign-in to your **CSP-model M365 tenant**
6) Follow the prompts to provide MSP Process with the required permissions:

7. You'll be brought back to the MSP Process UI
8. If you then click into the **Microsoft Authenticator** chip, you'll see the child tenants we've been able to successfully setup:

At this point, you've setup MSP Process to use Microsoft Authenticator to verify the end-users in that M365 tenant with their Microsoft Authenticator app.

You'll now see Microsoft Authenticator available as an option within your PSA:

**ConnectWise/Halo PSA:**

**Autotask:**

**Please Note:** If you are experiencing your end-users not syncing even after setting up the GDAP integration or an error that advises "The refresh token has expired due to inactivity", please go through setting up the GDAP integration one more time. You can re-use the App Registration and Enterprise app that were already deployed, you will just need to grab a new Client Secret.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.