Connect Microsoft 365 clients

Automagically runs IT automation in your clients’ Microsoft 365 tenants. This page covers how it connects to each tenant, what you set up once as an admin, what each technician does, and how to fix the common problems.

​

What you get

• GDAP clients connected with no client action. Automagically is authorized in each GDAP client through Partner Center. The client’s admin doesn’t click anything.
• Per-technician access. In GDAP clients, Automagically acts with each technician’s own GDAP roles, and operations show under that technician in the client’s Microsoft audit logs.
• Direct clients too. Clients you don’t manage through GDAP connect with a one-time admin consent link.
• Your own tenant and a test tenant. Connect your MSP tenant for internal automation, and a staging tenant to test runbooks safely.

​

How the connection works (read this first)

GDAP clients are connected in two layers, and you need both:

1. The workspace connection (admin, once). Connect Partner Center and set up your GDAP app. This tells Automagically which clients you manage and lets it authorize itself in them.
2. Each technician’s sign-in (every technician, once each). Every technician who runs automations in GDAP clients connects their own Microsoft account. Automagically then acts with that technician’s GDAP roles: a technician can never do more through Automagically than their GDAP access allows.

If automations work for one technician but not another on the same GDAP client, it’s almost always layer 2.

​

Connect GDAP clients

​

Step 1: Connect Partner Center (admin)

Connecting Partner Center lets Automagically discover the clients you manage through GDAP and authorize itself in them. You need an account that is an Admin Agent in Partner Center and holds Application Administrator (or higher) in Entra ID. You can remove Application Administrator from the account once the connection is made. It’s only needed again if you reconnect. The account must belong to your own partner tenant:

• It must be a member of the tenant, not a guest.
• It doesn’t have to be your Thread login. A separate privileged admin account works.
• Your Thread login’s email domain must be a verified domain in that tenant, and your Thread email must exist as a user there.
• If your Partner Center is in a different tenant from your email domain, contact Thread support before you connect.

Automagically checks the account belongs to your partner tenant. Partner Center then appears on the Microsoft 365 card as Connected, and the wizard lists your GDAP tenants.

Why does Partner Center need User.ReadWrite.All?

When you connect, Automagically checks that the account belongs to your own partner tenant and that your Thread email is a user there. That protects you from someone connecting your Partner Center to a different Thread workspace. Microsoft accepts this permission for the user lookup, and the Automagically app already holds it, so the connection asks for nothing new. Automagically only reads with it during the connect.

​

Step 2: Set up your GDAP app (admin)

Microsoft only lets a partner authorize an app in its customers through Partner Center when the partner owns the app. So Automagically creates a copy of its app in your own tenant, owned by you, called Automagically - M365 GDAP. All GDAP work runs as this app. You need Cloud Application Administrator or higher (for example Application Administrator or Global Administrator) in your own tenant. Partner Center must be connected first. The flow takes about a minute. A sign-in from any tenant other than your Partner Center tenant is refused. When the app becomes active:

• Every GDAP client you’ve already mapped is authorized automatically.
• Each technician reconnects Your Microsoft sign-in once, because their earlier sign-in was made with Thread’s app.
• Direct clients aren’t affected.

The app’s certificate lasts 2 years. The row shows Expires soon when it’s due. Contact Thread support to renew it.

​

Step 3: Map and authorize your GDAP clients (admin)

On the Microsoft 365 clients page, click Connect with GDAP and map each client to its Microsoft tenant. Automagically then authorizes your GDAP app in that client through Partner Center, applies the app’s permissions and checks the client’s GDAP roles. The client’s admin doesn’t do anything. Authorization also runs:

• For every mapped client, when your GDAP app becomes active.
• When you click Authorize on a client.
• For all clients, when you click Authorize all GDAP clients. Tick Also update clients authorized with an older permission list to bring older authorizations up to date.

Each client needs an active GDAP relationship that grants Cloud Application Administrator, Application Administrator or Global Administrator to a security group your Partner Center account is in. Each GDAP client shows one of these statuses in the Partner Center column of the clients table. A client you Disconnect stays disconnected until you click Authorize on it. Discovering, mapping again or Authorize all GDAP clients won’t reconnect it.

​

Step 4: Each technician connects their Microsoft account

Every technician who runs automations in GDAP clients signs in once: When you run an automation in a GDAP client, Automagically asks Microsoft for access to that client on your behalf, and Microsoft only grants what your GDAP roles allow there. You stay connected from then on: Automagically refreshes idle Partner Center and technician sign-ins daily. If Microsoft stops accepting a sign-in, the row shows Reconnect needed and why.

​

Required GDAP roles

Automagically checks each GDAP client’s relationships for these roles. A client connects as long as it has at least one, and lists any that are missing. Automations that need a missing role fail in that client. A client with none of them shows Failed. Technicians must be members of the GDAP security groups these roles are assigned to in Partner Center.

​

Connect direct clients

For clients you don’t manage through GDAP, the client’s Microsoft admin approves the Automagically app once. They don’t need a Thread account. The consent covers everything Automagically can automate in that one tenant: users and groups, sign-in and MFA, mail and Exchange, Teams, SharePoint and OneDrive, Intune devices and security policy. See What the permissions are for below for the full list. DAP clients. Partner Center also discovers clients you still manage through DAP, the older Delegated Admin Privileges. They connect with admin consent, like direct clients. Microsoft recommends moving them to GDAP.

​

What the permissions are for

When a client’s admin approves Automagically - M365, or you grant consent for Automagically - M365 GDAP, Microsoft shows a long list of permissions. It’s long for three reasons.

1. Most permissions appear twice. The first half of the list is application permissions, worded like “…in all mailboxes” or “…all site collections”. Automagically uses them for direct clients, your MSP tenant and your staging tenant. The second half is the matching delegated permissions, worded like “…user mail” or “Send mail as a user”. Automagically uses them in GDAP clients, where it acts as the signed-in technician and can’t do more than that technician’s GDAP roles allow.
2. One consent covers every runbook. Consent is given once per tenant, not once per runbook, so the app asks for what every supported runbook might need. What actually runs is still controlled by runbook approval, Automagically roles, and (in GDAP clients) each technician’s GDAP roles.
3. Some areas use more than one Microsoft API. “Have full control of all site collections” appears four times because it’s granted in both Microsoft Graph and SharePoint, each as an application and a delegated permission. The “Manage Exchange…” permissions come from Exchange Online, because tasks like mail forwarding, shared mailboxes and mailbox permissions aren’t available in Microsoft Graph.

​

Connect your staging tenant

Staging tenant: on the Microsoft 365 card, click Connect staging tenant to link a test tenant and try runbooks before they reach real clients. You can finish setup with only a staging tenant and connect clients later.

​

Troubleshooting

​

FAQ