M365 CSP/GDAP Permission Checker Crate

What does the M365 CSP/GDAP Permission Checker Crate do?

This Crate gives you a simple way to help validate that your GDAP roles and permissions are correct and assigned to the appropriate account. Your Rewst service account that is used to manage your Microsoft tenants requires specific GDAP roles in order to perform it's various actions. The Administrative Relationships set up for each customer in Microsoft CSP must also match those roles tied to the user. The workflow in this Crate is designed to identify if any of these roles are correct and assigned to the appropriate account for a specified org.

For more information on the recommended GDAP roles, see the Best Practices for Microsoft Integration page in our documentation.

Crate prerequisites

The Microsoft Graph integration must first be set up before unpacking this Crate.

Unpack the M365 CSP/GDAP Permission Checker Crate

1. Navigate to Crates > Crate Marketplace in the left side menu of the Rewst platform.

2. Search for M365 CSP/GDAP Permission Checker.

3. Click on the Crate tile to begin unpacking.

4. Click Unpack Crate.

5. Click Continue.

   
6. Enter your time estimate into the Time Saved (seconds) field.

7. Expand the Always Pass accordion menu. Ensure that Activate for all current and future managed organizations is toggled on to allow you to run the Crate ad-hoc for any of your client accounts.

8. Click Unpack.

How to use the Crate

1. Navigate to Automations > Workflows.

2. Search for [ROC] M365: CSP/CPV Permission Checker. Click on the workflow to open it in the workflow builder.

   
3. Within the [ROC] M365: CSP/CPV Permission Checker main workflow, click Test.

4. Select the tenant you want to check permissions for from the Trigger Context Organization dropdown menu. This list is derived from the organizations enabled in your trigger configuration.

5. Enter the domain associated with the managing organization's tenant in the Primary Domain of the MSP field.

   
6. Click Test.

7. Click View Results.

8. Click Load Context.

9. Click to expand all s in the context code. The errors messages contained within this record will indicate if roles are present or missing. For example:

"missing_roles": [
  {
    "ID": "No ID associated with no user",
    "Name": "Security Administrator",
    "Note": "No users assigned to this role.",
    "Found": false,
    "Principal Organization IDs": []
  },
  {
    "ID": "No ID associated with no user",
    "Name": "Authentication Policy Administrator",
    "Note": "No users assigned to this role.",
    "Found": false,
    "Principal Organization IDs": []
  }
]

Technical execution of the Crate

Workflow steps

{{ CTX.tenant_info.authorization_endpoint.split('/')[3] }}

"missing_roles": [
  {
    "ID": "No ID associated with no user",
    "Name": "Security Administrator",
    "Note": "No users assigned to this role.",
    "Found": false,
    "Principal Organization IDs": []
  },
  {
    "ID": "No ID associated with no user",
    "Name": "Authentication Policy Administrator",
    "Note": "No users assigned to this role.",
    "Found": false,
    "Principal Organization IDs": []
  }
]