Skip to content
More support Customer portal
  • There are no suggestions because the search field is empty.

Microsoft Permissions Troubleshooting (GDAP & Consent Setup)

If consent fails for a customer while you set up the Microsoft Module, it's almost always a permissions setup issue in Microsoft. Work through these steps in order.

First: which consent option are you using?

  • Option A, the customer's own admin account: you sign in as an admin in that customer's Microsoft tenant. No GDAP setup is needed. If consent fails, make sure the account is a Global Administrator in that customer's tenant, then go to Step 4.
  • Option B, one partner account for all customers (GDAP): follow every step below.

Step 1: Note the error Gradient shows

When consent fails, Gradient shows Microsoft's error code and message in an alert above the GDAP Review table. Copy it or take a screenshot. Support will need it if these steps don't fix the problem.

While you're there, check the customer's status in Microsoft Integration > GDAP Review. If it shows Expired, go straight to Step 5.

Step 2: Confirm the GDAP relationship includes both roles

  1. Sign in to Partner Center.
  2. Go to Customers, select the customer, then select Admin relationships.
  3. Open the active relationship and check its Microsoft Entra roles.

It must include both Application Administrator and Privileged Role Administrator. One without the other isn't enough.

If either role is missing, you can't add it to the existing relationship. Microsoft only lets you choose roles when a relationship is created. Go to Step 6.

Step 3: Confirm your account is in the security group that holds those roles

The roles reach your account through a security group. Having the roles on your own user account isn't enough.

In Partner Center, on the same relationship:

  1. Under Security groups, find the group that has both roles assigned.
  2. If no group has both, select Add security groups, choose a group, select both roles and click Save. The status shows Pending, then Active after about 30 seconds.

In the Microsoft Entra admin center for your partner tenant:

  1. Go to Groups > All groups and open that security group.
  2. Select Members.
  3. Confirm the account you'll sign in with during consent is listed. It must be a direct member, not included through another group. Add it if it's missing.

Step 4: Sign out completely, then try again

  1. Sign out of every Microsoft account in your browser. A private or incognito window also works, and makes sure you're not signed in to a different Microsoft account.
  2. Sign back in with the account from Step 3.
  3. In Gradient, go to Microsoft Integration > GDAP Review and click Consent for the customer again.

Signing out refreshes your session so Microsoft picks up your new group membership and roles. GDAP changes can take up to an hour to show in Gradient.

Step 5: If the GDAP relationship has expired

An expired relationship can't be turned back on. Request a new one (Step 6), then complete Steps 3 and 4.

To stop this happening again, turn on Auto extend for your active relationships in Partner Center, where it's available. It extends a relationship by six months at a time.

Step 6: Request a new GDAP relationship

  1. In Partner Center, go to Customers, select the customer, then Admin relationships > Request for new relationship.
  2. Under Select Microsoft Entra roles, include Application Administrator and Privileged Role Administrator, plus any other roles your team needs.
  3. Set the duration (up to 730 days) and turn on Auto extend if you'd like.
  4. Select Finalize request and send the email to your customer.
  5. A Global Administrator in the customer's tenant approves the request from the link in the email.

Once the relationship is Active, complete Steps 3 and 4. Need to connect this customer now? Use Option A with the customer's own admin account while you wait.

Still stuck?

Email support@meetgradient.com with:

  • The error code and message Gradient showed (a screenshot is fine)
  • The customer's name
  • The name of the GDAP relationship you're using
  • The roles assigned to its security group
  • A screenshot showing your consenting account as a member of that group

Related articles

🦩   Need a hand? Reach out to support@meetgradient.com   🦩