← frankieryan.com

Index / Integrations

LIFECYCLE MANAGER

Integrating with Microsoft 365 (Multi-Tenant)

Originally published on Lifecycle Manager's help center · View live article ↗

Why this piece is featured

A six-phase Entra ID and Partner Center setup spanning service-account creation, GDAP relationships, and role elevation, with a genuine security best practice built in: use Global Administrator only for initial setup, then downgrade it.

The Microsoft 365 Multi-Tenant integration lets you sync Microsoft 365 data from multiple tenants in one place. This article walks you through the setup steps in Microsoft Entra ID and Partner Center, then shows you how to connect the integration and complete the initial sync.

Before you begin

  • You have access to the Microsoft Azure portal for your partner tenant, and to Microsoft Partner Center.
  • You can create and manage users, security groups, and role assignments in Microsoft Entra ID.
  • You are able to create a dedicated service account and complete first-time sign-in and MFA enrolment. This account must have Multi-Factor Authentication enabled using Microsoft Authenticator push notifications — if MFA is enabled any other way, Microsoft's APIs can report the account as having no MFA, which can cause the sync to fail.
  • Your customer tenants use Granular Delegated Admin Privileges (GDAP), and each tenant either has an active GDAP relationship with the required roles, or can accept a new one.

Who can add this integration? Administrators, or users with Manage Sync Settings permission.

Step 1: Creating a dedicated service account

A dedicated service account is required to provide authorization to Lifecycle Manager. Creating a new account ensures it's set up correctly.

  1. Go to the Microsoft Azure portal.
  2. From the Azure home screen, select Microsoft Entra ID (or use the search bar to find the Entra ID service).
  3. In the left navigation panel, expand Manage and select Users.
  4. At the top of the Users page, click + New user and select Create new user.
  5. Enter the user details: a user principal name (for example, LifecycleManagerServiceAccount), a display name, leave auto-generate password enabled, and ensure the account is enabled.
  6. Click Review + Create, then click Create. This creates the service account Lifecycle Manager will use later.
  7. Sign in once using this account to complete Microsoft's first-time setup and MFA enrollment. This step is required for the integration to authenticate successfully.

Step 2: Assigning the required Microsoft roles to the service account

Assigning the correct roles ensures the service account has the access it needs to authorize and retrieve data during setup.

  1. In Entra ID, open Users, then click the name of the user created in Step 1.
  2. In the left navigation menu, click Assigned Roles, then + Add assignments.
  3. Search for Global administrator, check the box beside it, then click Add.
  4. Confirm Global Administrator shows in the list of assigned roles.

Note

The Global Administrator role is only required for initial setup. After the integration is connected and authorization is complete (Step 6), you can remove Global Administrator and replace it with Application Administrator or Cloud Application Administrator.

Step 3: Add the service account to the AdminAgents group

The AdminAgents group is required for Partner Center API access.

  1. In Entra ID, select Groups, search for AdminAgents, and open it.
  2. Click Members, then + Add Members.
  3. Search for the service account created in Step 1, check the box, and click Select.
  4. Confirm the service account appears in the group's member list.

Step 4: Create a GDAP Lifecycle Manager group

  1. In Entra ID, expand Manage and select Groups, then click + New group.
  2. Fill in the group details: security group type, a descriptive name (for example, GDAP Lifecycle Manager), assigned membership type, and default values for everything else.
  3. Click Create, then open the new group and select Members.
  4. Click + Add members, find the service account from Step 1, select it, and click Select.
  5. Confirm the service account appears in the group's member list.

Step 5: Update GDAP relationships in Partner Center

Your GDAP Lifecycle Manager security group must be associated with each customer tenant you manage, through delegated admin relationships in Microsoft Partner Center.

  1. In Partner Center, under Workspaces, select Customers, then select a customer.
  2. Select Admin relationships and open the active GDAP relationship.
  3. Identify the security group(s) assigned with these roles: Application Administrator, Cloud Application Administrator, Privileged Role Administrator.
  4. In a new tab, open Entra ID, go to that customer's GDAP group, select Members, then + Add members.
  5. Search for and select the GDAP Lifecycle Manager group created in Step 4, then click Select.
  6. Repeat for each customer tenant.

If no GDAP relationship exists for a customer

  1. In Partner Center, request a new GDAP relationship with the roles listed above.
  2. Once the customer accepts, follow the same steps to add the GDAP Lifecycle Manager group to the new GDAP security group.

Step 6: Connect Microsoft 365 Multi-Tenant in ScalePad

  1. From the ScalePad Hub, click Integrations, then Add integration.
  2. Under the SaaS category, click the Microsoft M365 Multi-Tenant tile.
  3. Click Connect & Continue. A Microsoft login window appears.
  4. Sign in using the dedicated service account from Step 1, and complete MFA if prompted.

After authorization succeeds, the integration appears in your list of connected integrations.

Note

Once authorization is complete, you can remove the Global Administrator role from the service account and replace it with Application Administrator or Cloud Application Administrator, to limit the account's access to only what Lifecycle Manager needs.

Sync timing

A successful connection indicates authorization is complete. The initial sync can take up to 48 hours — this is expected and doesn't require any action during that time.

← Back to index