> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/getting-started/the-10-step-setup-guide/step-2.-create-your-gdap-relationship-request.md). # Step 2. Create your GDAP relationship request If your tenant needs a new GDAP relationship, select **Create GDAP relationship**. Augmentt auto-selects all 16 Microsoft Entra roles it requires, plus the AdminAgents security group. Selecting **Create Request** creates the relationship, which then needs approval on the tenant's end. {% hint style="info" %} Augmentt's required role set grows as new functionality ships. If an existing tenant later shows missing roles in the GDAP audit, you don't need to recreate the relationship — extend it and re-apply Delegate Access. {% endhint %} Once connected, use **Manage CSP Setup** to open the GDAP Audit tool and validate whether your tenants have the necessary GDAP permissions. A tenant showing green across the board is ready for **Create & Map Companies**. ## The 16 required roles When you select **Create GDAP relationship**, Augmentt requests exactly these 16 Microsoft Entra roles on your behalf: | Role | What it does and controls | | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Application Administrator** | Manages app registrations and enterprise applications, including consent to API permissions. This is the one role Augmentt strictly requires to connect at all — without it, the GDAP relationship can't be used to manage the tenant through Augmentt. | | **User Administrator** | Creates, updates, deletes, and resets passwords for users; manages licenses assigned to users. Core to Augmentt's user management features. | | **Password Administrator** | Resets passwords for non-administrator users and other Password Administrators. | | **Groups Administrator** | Creates and manages groups, group settings, and group membership across the tenant. | | **License Administrator** | Assigns, removes, and manages product licenses for users and groups, without needing broader user-management rights. | | **Exchange Administrator** | Manages Exchange Online — mailboxes, mail flow rules, and mail-related settings — used for Augmentt's Exchange visibility and controls. | | **SharePoint Administrator** | Manages SharePoint Online and OneDrive settings, sites, and storage across the tenant. | | **Teams Administrator** | Manages Microsoft Teams settings, policies, and configuration tenant-wide. | | **Intune Administrator** | Manages device compliance, configuration profiles, and enrollment through Microsoft Intune. Only needed if you want to manage that tenant's Intune policies through Augmentt — see below. | | **Security Administrator** | Manages security features across Microsoft 365 security centers, including reading security reports and configuring security policies. | | **Compliance Administrator** | Manages compliance-related features in Microsoft Purview, such as data loss prevention, retention, and audit configuration. | | **Authentication Administrator** | Sets or resets authentication methods for non-administrator users and a limited set of admin roles; can require re-registration of MFA. | | **Authentication Policy Administrator** | Configures tenant-wide authentication method policies and settings, such as which MFA methods are allowed. | | **Privileged Authentication Administrator** | Sets or resets authentication methods for *any* user, including other administrators — a broader version of Authentication Administrator. | | **Conditional Access Administrator** | Creates and manages Conditional Access policies, which control the conditions under which users can sign in. | | **Privileged Role Administrator** | Manages role assignments in Microsoft Entra ID, including assigning other administrator roles and managing Privileged Identity Management (PIM). | {% hint style="info" %} Global Administrator is deliberately **not** on this list. See the note below on why Augmentt avoids requesting it. {% endhint %} ## Reading the GDAP audit results After connecting your Partner Center, Augmentt lists every detected customer and flags each one's readiness: * **GDAP ready (green)** — just check the box and hit **Create Companies**. Done. * **Possible limitations** — expand the row to see exactly which of the 16 required roles are missing. **Application Administrator** is the one role that's strictly required to connect to Augmentt at all; without the rest, the connection succeeds but you won't be able to manage security or users — so a tenant showing only that role present still needs the remaining roles added before it's useful. * **Not ready** — no existing GDAP relationship at all yet. Sometimes a tenant is missing only one specific role — for example, Intune. If you don't intend to manage that tenant's Intune policies through Augmentt, you don't need to fix that gap; you can connect and use everything else as-is. ## Why use Augmentt to create the relationship instead of doing it in Partner Center Creating a GDAP relationship manually means: create the relationship, add each of the 16 roles individually, add the AdminAgents security group, then assign the same roles to that group. Augmentt does all of this in one step, and additionally sets the relationship to its maximum duration and turns on auto-extend. {% hint style="warning" %} Microsoft recommends against including Global Admin in a GDAP relationship. If Global Admin is included, Microsoft won't allow auto-extend on that relationship — someone has to manually renew it before it expires. Augmentt's role set is built to avoid needing Global Admin at all. {% endhint %} Next: Step 3. Approve your GDAP relationship requests --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/getting-started/the-10-step-setup-guide/step-2.-create-your-gdap-relationship-request.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.