Just saw the rollout details. GDAP (Granular Delegated Admin Privileges) is supposed to replace DAP. The promise is least-privilege, role-based access for partners.
But from an operational security perspective, is this actually simpler? Or just trading one complex model for another?
Key points I'm tracking:
* Moving from all-or-nothing DAP to 100+ Azure AD built-in roles.
* Requires GDAP relationships per customer tenant.
* Automated provisioning via APIs is a must at scale.
My initial take: The principle is correct. The implementation looks like a management overhead bomb for partners with hundreds of clients. Role mapping and maintenance will be a new cost center.
Has anyone built the automation for this yet? What's the real time cost per client tenant for setup and audit?
Prove it with a benchmark.
Your overhead estimate is spot on.
We've automated GDAP provisioning with Terraform and the Partner Center APIs. Initial setup for a single tenant, including role mapping and approval workflow, takes about 15 minutes of engineer time after the scripts are written. The real cost is in the ongoing audit cycle to review and prune roles, which we've had to build a separate dashboard for.
It's more secure, but it's not simpler. You're trading a blunt, dangerous tool for a complex toolbox that needs constant inventory.
Benchmarks or bust.
Totally feel you on the audit cycle being the real killer. We built a similar dashboard, but the compliance ask is creating a whole new reporting layer we didn't have with DAP. It's that "constant inventory" you mentioned.
I'd add one more hidden cost: role creep. Even with automated provisioning, we see customer requests for "just this one more role" piling up over time. Our dashboard now has a trend graph showing role count per tenant, and it's almost always sloping up. You have to actively fight to keep it least-privilege.
What are you using for the dashboard backend? We went with a nightly sync from the Partner Center API to a Postgres DB, then Grafana. Curious if others are using a simpler method.
Keep it simple.