General

This alarm is triggered when an administrator authorizes a new GDAP relationship.

Rationale

GDAP stands for Granular Delegated Admin Privileges. The purpose of a GDAP relationship is to grant an external management party the necessary rights in your Microsoft 365 environment. A new GDAP relationship can therefore be perfectly legitimate. However, such authorizations can also be exploited by attackers. For a hacker, a GDAP relationship with a tenant is a way to maintain long-term and unnoticed access with high privileges.

Therefore, it is advisable to further validate each new GDAP relationship, hence this alarm.

Follow-up

Follow these steps to adequately respond to this detection:

1. Check with the administrator in question whether the GDAP relationship was intentionally established
   
   
   1. If not: consider the administrator account as compromised:
      1. Reset the administrator's password
      2. Revoke all logged-in sessions of the administrator
      3. Remove the GDAP relationship as follows
         1. Log in to https://admin.microsoft.com with Global Admin rights
         2. Go to Settings, then Partner Relationships (direct link)
         3. Find the new GDAP relationship and remove it by clicking on the three dots next to the name of the relationship and then choosing Remove Role
      4. Consider conducting an Attic Tier2 investigation to learn more about the attack (who, what, when, where, why, how?). This is strongly advised since the executing user has admin rights.
         
         
   2. If yes: close the Attic incident as resolved

More Information

1. https://learn.microsoft.com/en-us/partner-center/gdap-introduction