GDAP
Connect every Microsoft 365 customer you manage through GDAP from one Partner Center sign-in.
The GDAP integration connects Uniportal to your customers' Microsoft 365 tenants through the GDAP relationships you already have in Partner Center. You sign in once from your partner tenant, pick which customers Uniportal should manage, and Uniportal onboards each one without you signing in to every customer tenant separately.
If you manage a customer's Microsoft 365 without GDAP, use M365 Single Tenant for that customer instead.
Companies start here
The Microsoft 365 integrations are what create companies in Uniportal. Every customer you onboard becomes a Uniportal company, and that company is what records in your PSA, documentation, RMM, and other integrations get mapped to. Right now there's no way to create a company in Uniportal by hand, it has to come from Microsoft 365 or Google Workspace.
So if you're setting up a new tenant, connect Microsoft 365 before you start mapping companies in your other integrations. Otherwise there's nothing on the Uniportal side to map them to.
How the connection works
Uniportal doesn't ask for a new relationship with your customers. It works through your existing GDAP relationships, which already define what your partner tenant is allowed to do in each customer tenant.
When you onboard a customer, Uniportal uses that GDAP access to create a Uniportal service principal inside the customer's tenant. That service principal is what the AI actually acts through day to day. It lives in the customer's tenant, so it shows up in their Entra ID enterprise applications like any other app, and removing it cuts Uniportal off from that customer cleanly.
Prerequisites
- A Global Administrator account in your partner tenant that also has access to Partner Center. Global Admin is needed to consent to the Uniportal application on behalf of your organization, and Partner Center access is how Uniportal reads your list of GDAP customers.
- GDAP relationships with the customers you want to onboard, including these Microsoft Entra roles:
- Application Administrator or Cloud Application Administrator
- Privileged Role Administrator
- Admin/Owner role in your Uniportal tenant.
The two roles each cover one half of onboarding. Application Administrator (or Cloud Application Administrator) lets Uniportal create its service principal in the customer tenant. Privileged Role Administrator lets it grant that service principal its API permissions, which Microsoft treats as a privileged action because application permissions work without a signed-in user. Without both, onboarding stops halfway, so Uniportal checks for them up front and marks the customer Not Ready instead.
Setup
Connect and consent
- In the Uniportal dashboard, go to Integrations.
- Select the Microsoft 365 (CSP) tile.
- Click Connect and sign in with the Global Admin account from your partner tenant.
- When Microsoft asks for consent, check Consent on behalf of your organization and accept.
Consenting on behalf of the organization is what grants the Uniportal application its permissions across your partner tenant, not just for your own account. That's why this has to be a Global Admin: it's the role Microsoft requires to grant admin consent.
Choose which customers to onboard
Once you're authenticated, Uniportal lists every customer you manage through GDAP. You don't have to onboard all of them. Select the customers you want Uniportal to manage and click Onboard.
Onboarding creates the Uniportal service principal in each selected customer's tenant and adds the customer as a company in Uniportal. Customers you leave unselected are untouched: nothing is created in their tenant.
You can come back to this screen at any time to onboard more customers.
Map companies in your other integrations
With your customers onboarded as companies, go to your PSA, documentation, RMM, and other integrations and map their records to these companies. See Integrations for how mapping works in each one.
Control access to Microsoft 365 tools
Microsoft 365 tools show up on the Agent Tools page like any other integration's. Set a Mode on each one, Automated, Approval Required, or Disabled. Reading a user's details and changing what they have access to are not the same level of risk, so set them separately.
Modes apply to everyone. To decide which technicians can use which tools, set up custom roles under Team & Roles. Microsoft 365 tools are listed there when you build a role, so a tier 1 tech can have the tools that read user and license details while the tools that change accounts stay with your senior techs.
Syncing data
Connected customers sync automatically every 4 hours, pulling in end-users and other tenant data. When you need something fresher than the last sync, like a user Pam just created in the admin center five minutes ago, click Sync now on the customer.
You can also ask the AI Assistant to sync a single customer from chat, for example "sync Microsoft 365 for Dunder Mifflin Scranton." That's handy mid-ticket when the user you're looking for isn't showing up yet.
End-users sync after a customer is onboarded, not during onboarding, so the list can be empty for a few minutes afterward. If it's still empty, click Sync now and refresh the page.
Offboarding a customer
Offboarding a customer removes the Uniportal service principal from their tenant. From that point on, Uniportal has no access to that customer's Microsoft 365, regardless of what your GDAP relationship allows. Your GDAP relationship itself isn't changed.
The company stays in Uniportal, along with its mappings to your PSA and other integrations. If you onboard the same tenant again later, Microsoft 365 or Google Workspace, it reconnects to that same Uniportal company instead of creating a second one. Offboarding is safe to use as a pause, not just a goodbye.
Reconnecting
If you see authentication errors, or a tool fails because of a missing permission, click Reconnect on the Microsoft 365 (CSP) tile. That runs the sign-in and consent again without disconnecting anything, so your onboarded customers and every company mapping you've done stay in place.
The most common reason you'll need this is a Uniportal update. When we add a new Microsoft 365 tool that needs an application permission the integration didn't have before, your existing consent doesn't cover it.
Getting a new permission all the way to your customers takes two steps:
- Click Reconnect to grant the new permission in your partner tenant.
- Onboard each customer again, selecting them and clicking Onboard, to add the new permission to their service principal.
The second step is needed because each customer's service principal carries its own permission grants, set when it was onboarded. Reconnecting updates your consent, not the service principals already sitting in customer tenants. Onboarding a customer again doesn't disconnect it or touch its company or user mappings, it just brings the permissions up to date.
Troubleshooting
Customer shows Not Ready
Not Ready means the GDAP relationship with that customer is missing one or more of the required roles. Click the customer's GDAP column to see exactly which roles are missing.
Add those roles to the GDAP relationship in Partner Center, then come back and onboard the customer. Uniportal can't add them for you: GDAP roles are granted by the customer approving the relationship, which is the point of GDAP.
Warning that a GDAP relationship is expiring, with auto-extend on
If a customer shows a warning that its GDAP relationship is about to expire, but you've turned on auto-extend for that relationship in Partner Center, you don't need to do anything. The warning shows because the relationship is close to its current end date, and that date only moves once Microsoft actually runs the extension. Once the relationship auto-extends, the warning goes away on its own.
If auto-extend is off, extend or renew the relationship in Partner Center before it expires.
End-users aren't showing up
Onboarding a customer doesn't import their users right away. Give it a few minutes, then click Sync now on the customer and refresh the page.