Microsoft Cloud Integration Bundle

Were you a Rewst Classic customer? Microsoft integration is now easier in Rewst. The in-platform setup wizard will walk you through all the needed steps for integration.

What is the Microsoft Cloud Integration Bundle?

Rewst can't work with Microsoft 365 and its related apps until you've given it permission to. Setting up the Microsoft integration is how you give that permission: first for your own company, then for each customer you manage.

Find the Set up button to start integration for Microsoft at the top of your Integrations page.

When setup is finished, Rewst can do Microsoft 365 admin work for you and your customers automatically. For example:

• Create a new user: make the account, assign licenses, add them to groups

• Remove a user: block sign-in, remove licenses, hand the mailbox to someone else

• Reports: list users, licenses, MFA status, and security settings for every customer

• Mail tasks: shared mailboxes, forwarding, distribution lists - these use Exchange Online, which is part of the same setup

Though you’ll be working from one integration menu tile to set up all integrations, each integration will appear as its own section with its own actions in the actions list of the workflow builder.

How does the Microsoft integration work?

Rewst gets its access to your customers through Microsoft's partner program:

• Cloud Solution Provider (CSP): Microsoft's program for IT providers who resell and manage Microsoft 365 for customers. Your Partner Center account is where this is managed.

• Granular Delegated Admin Privileges (GDAP): a permission agreement between you and each customer. It sets exactly which admin rights you hold in that customer's Microsoft 365, and for how long. The customer has to approve it.

The chain looks like this:

Rewst never stores a separate password for each customer. It works through your company's partner connection, and it can only do what each customer's GDAP permissions allow.

What integrations are in the Microsoft Cloud Integration Bundle?

The Microsoft Cloud Integration Bundle contains integrations for:

1. Microsoft Graph: A unified API that provides a single endpoint for accessing and managing data and intelligence across Microsoft 365, Windows, and Enterprise Mobility and Security.

2. Microsoft Exchange Online: The cloud-hosted version of the traditional Microsoft Exchange Server, offering similar functionalities but without the need for on-premises server infrastructure.

3. Microsoft Cloud Solution Provider (CSP): This allows for the resale of Microsoft cloud services like Azure, Microsoft 365, and Dynamics 365 to businesses, often with added value services. It's a subscription-based model where MSPs can bill customers.

4. Microsoft Azure: A cloud computing platform, Azure offers a range of cloud infrastructure services, including computing, analytics, storage, networking, and AI. Note that Microsoft formerly called a different tool Azure, and renamed that tool Microsoft Entra.

Set up the Microsoft Cloud Integration Bundle

Follow our in-platform wizard to set up the Microsoft Cloud Integration Bundle. Below is a high-level overview of what will happen during all the steps. While the Rewst Agent can help you with questions and setup, much of the credentialing and information entered as part of the setup process must be done by you.

High-level overview of setup

1. Connect Rewst to your own company's Microsoft account

• Someone with Global Admin rights in your company's Microsoft 365, who also has access to Partner Center, signs in through Rewst's setup screen.

• They approve and consent to the Rewst app. This adds Rewst as a trusted app in your company's Microsoft account.

• Result: Rewst is linked to your company.

2. Make sure each customer has an active GDAP relationship

• Each customer needs a GDAP relationship with you, and the customer must accept it.

• Many IT providers already have these in place. If a customer doesn't, you request one in Partner Center (or through Rewst's tools) and the customer approves it.

• Result: you have a legal, time-limited admin connection to each customer.

3. Choose a permission level

• Rewst offers ready-made permission tiers, roughly from least to most access: Auditor for read-only, Helpdesk, Infrastructure, Automation, Global Admin, and Custom.

• You pick a default tier for all customers, and you can change it for individual customers.

• A good rule: give Rewst only the level your automations actually need.

• Result: Rewst knows how much it may do in each customer's account.

4. Apply those permissions to each customer

• Rewst pushes your chosen permissions to each customer's account.

• Result: Rewst's app is allowed inside each customer's Microsoft 365, at the level you chose.

5. Match Microsoft customers to Rewst customers

• Rewst pulls your customer list from Microsoft. Each Microsoft customer gets linked to the matching customer in Rewst.

• Result: when an automation runs "for Customer A," Rewst knows which Microsoft account to act on.

6. Test with something harmless

• Run a read-only task against one customer first, like listing their users.

• Result: you've confirmed the whole chain works before running anything that makes changes.

If you aren't a Microsoft partner (CSP), or you only want to manage one Microsoft account— for example, your own company's— , setup is simpler. You connect that one account directly and skip the GDAP steps.

What you'll need before you start

Item	Why
A Microsoft Global Admin in your own company	To approve the Rewst app in step 1
Access to Partner Center (CSP)	Customer relationships and GDAP are managed there
Customers willing to approve GDAP requests	Only needed for customers who don't already have one
Admin rights in Rewst	To run the Microsoft setup inside Rewst
A decision on permission level	"Read-only reports" and "full user management" need different tiers

What is GDAP and why is it important to the setup process?

In 2024, Microsoft moved away from regular user-based access, where users logged into Microsoft Entra with an individually permissioned account. Instead, they now operate via delegated admin permissions, where permissions are assigned from the top level down, for more secure access management. This is known as Granulated Delegated Admin Permissions, or GDAP.

GDAP templates in Rewst

Rewst has no single, optimal role set for GDAP within the integration configuration. It defines tiers, with each tier mapping to a list of GDAP roles. You choose the tier based on what your automations need to do, via the in-wizard prompts while setting up the integration.

If you were a Rewst Classic customer, the Full Management tier is closest to what was recommended and used in Rewst Classic's Microsoft Cloud Integration Bundle.

Tier	Purpose	GDAP roles
Monitor	Read-only	Directory Readers, Global Reader
Helpdesk	User support actions	Monitor's roles, plus user Administrator and Privileged Authentication Administrator
Services Admin	Managing workloads	Helpdesk's roles, plus Exchange Administrator, Intune Administrator, Teams Administrator, SharePoint Administrator, and Cloud Device Administrator
Full Management	Complete automation	Application Administrator, Authentication Policy Administrator, Cloud App Security Administrator, Cloud Device Administrator, Exchange Administrator, Intune Administrator, User Administrator, Privileged Authentication Administrator, Privileged Role Administrator, Security Administrator, SharePoint Administrator, and Teams Administrator
Full Control	Unrestricted	Global Administrator
Custom	You pick the roles	None preset

Troubleshoot the Microsoft Cloud integration bundle setup

Frequent errors stem from a customer's GDAP relationship that has expired or was never approved, or if the permission tier is set too low for the task. The automation then fails with a "permission denied" error for that one customer. Fixing that customer's GDAP or tier fixes it.

Your first step for any troubleshooting should be to ask the Rewst Agent to assess your situation and provide advice. For additional assistance, we have a separate guide with all bundle troubleshooting information. View that page here.