Overview
If you manage client tenants through Microsoft Partner Center, you can connect Petra directly to your CSP account. This lets you see all of your GDAP-managed tenants in one place, onboard them to Petra without needing each client’s Global Admin to approve individually, and manage permissions across tenants from a single table. Partner Center integration is available at app.petrasecurity.com/portal and is also offered during onboarding.Prerequisites
Before connecting, confirm the following:- You have a Microsoft Partner Center account with active GDAP relationships for the tenants you want to manage.
- The user connecting Partner Center is in the AdminAgents security group in your MSP tenant.
- The Azure AD application Petra M365 Security Analyzer is registered with delegated permissions. If you have not done this before, Petra will walk you through it during setup.
Connecting Partner Center
- Go to app.petrasecurity.com/portal, or click Add Tenant from the navbar and choose Continue with Partner Center.
- Click Connect Microsoft Partner Center.
- Sign in with your MSP tenant credentials on the Microsoft login page and consent to the requested permissions.
- After approval, you are redirected back to Petra. Your managed tenants will appear automatically.
You can also connect Partner Center during onboarding. The flow is the same; you will be redirected back to the onboarding wizard when finished.
Managing Tenants
Once connected, the managed tenants table shows every client tenant that has an active GDAP relationship with your MSP.What the table shows
| Column | Description |
|---|---|
| Tenant | Display name and Microsoft tenant ID |
| GDAP Permissions | Whether the GDAP relationship includes the roles Petra needs. Shows Ready or Missing. |
| Users | Number of users in the tenant (refreshed on sync) |
| Petra Status | Current onboarding state: Monitoring, Paused, Previously Deleted, or Not Protected |
| Email Perms | Whether Petra has the Exchange permissions it needs. Shows a Fix button if permissions need to be resynced. |
| Actions | Onboard, view, or request permissions depending on the tenant’s status |
Syncing tenants
Click Sync Tenants (in the overflow menu at the top of the table) to refresh the list from Microsoft. This queries your GDAP relationships and updates tenant names, user counts, and permission status.GDAP permission requirements
To onboard a tenant through Partner Center, your GDAP relationship must include one of these roles:- Global Administrator
- Application Administrator
- Cloud Application Administrator
Onboarding a Tenant
- Find the tenant in the managed tenants table.
- Confirm that GDAP Permissions shows Ready.
-
Select the product you want from the dropdown:
- Petra Active for continuous monitoring
- Petra Autopsy for a full 6-month forensic investigation
- Petra Scan for a quick security check (available on request)
- Click Onboard (or Add).
Batch scanning
If Petra Scan is enabled for your organization, you can scan multiple tenants at once. Use the checkboxes in the Exclude column to skip specific tenants, then click Scan or Onboard & Scan to run a scan across all eligible tenants in one step.Reauthenticating
If your OAuth session expires or you need to switch the connected account, open the overflow menu at the top of the table and click Reauthenticate Partner Center. This runs the same Microsoft sign-in flow as initial setup and replaces the stored credentials.How Petra Connects to Your Partner Center
Step 1: Initial authentication
When you connect Partner Center, Petra redirects you to Microsoft’s login page (login.microsoftonline.com) where you sign in with your MSP tenant credentials. You are asked to consent to the following permissions:
- Microsoft Graph:
DelegatedAdminRelationship.Read.All,DelegatedAdminRelationship.ReadWrite.All,User.Read.All,Organization.Read.All,Directory.ReadWrite.All,Application.ReadWrite.All,AppRoleAssignment.ReadWrite.All,DelegatedPermissionGrant.ReadWrite.All - Partner Center API:
user_impersonation
Step 2: Discovering client tenants via GDAP
When you sync tenants, Petra uses the stored refresh token to get a Microsoft Graph access token, then queries thetenantRelationships/delegatedAdminRelationships endpoint filtered to status eq 'active'. This returns only GDAP relationships that have been explicitly approved by the client tenant. Petra reads the roles and customer tenant IDs from these relationships and stores them locally for display.
Step 3: Onboarding a client tenant
When you click Onboard, two things happen:- Delegated permission consent via Partner Center API. Petra calls the Partner Center
/v1/customers/{tenantId}/applicationconsentsendpoint. This is Microsoft’s CPV (Control Panel Vendor) API, which installs the Petra application into the client tenant and grants delegated permissions (Graph, Exchange, Office 365 Management APIs). This operation is governed by the GDAP relationship and only succeeds if an active relationship with the required admin roles exists. - Application permission grants via Graph API. After the service principal is installed, Petra obtains a customer-tenant-scoped Graph token (using the GDAP relationship) and creates
appRoleAssignmententries on the Petra service principal. These are the application-level permissions needed for background operations like reading audit logs and managing mailbox settings without user context.
Security
- All access is mediated through GDAP. Petra cannot access any client tenant that has not approved a GDAP relationship with your MSP. If the relationship is terminated or expires, access is revoked.
- Delegated context. The Partner Center consent and Graph API calls operate in the context of the authenticated MSP admin user, bounded by their GDAP role assignments.
- No direct credentials. Petra does not store or use any client tenant passwords, certificates, or secrets. Access is entirely through OAuth tokens derived from the GDAP relationship.
- Revocable at any time. You can disconnect Partner Center from Petra at any time. Client tenants can terminate the GDAP relationship to immediately revoke access.