EIDTNT-016: Partner Delegated Admin Grant Hygiene (Long-Lived GDAP)
- Platform
- Entra ID / M365
- Category
- Entra ID Tenant Configuration
- Severity
- Medium
- Zero Trust pillar
- Governance (weight 2)
- Golden fixtures
- 5
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- original
What it checks
A GDAP relationship's duration is its auto-extension window: when it lapses it renews itself for that period without any human review. A long auto-extend (beyond a year) is therefore a standing, self-renewing grant of partner administrative access — the opposite of just-in-time — and is exactly the kind of forgotten relationship that outlives the engagement that created it. This check inspects active delegatedAdminRelationships and warns when any relationship auto-extends beyond 365 days; a relationship whose duration cannot be determined is treated conservatively as long-lived rather than assumed fine. It passes only when all active relationships auto-extend within a year. This is a hygiene/governance signal that complements EIDTNT-015 (which grades the privilege the partner holds); here the concern is how long the grant persists unreviewed.
Recommended value
All active GDAP relationships auto-extend within 365 days and are reviewed on each renewal
Remediation
For each active partner delegated admin (GDAP) relationship, set the shortest auto-extension duration that fits the engagement (avoid multi-year standing grants), and schedule a review at each renewal. In the Microsoft 365 admin center under Settings > Partner relationships, confirm each relationship is still required and terminate stale ones. Prefer short, renewable delegations over long-lived auto-extending access so that partner administration is re-authorized deliberately rather than by default.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| long-lived | WARN |
| no-partners | PASS |
| not-assessed | Not Assessed |
| short | PASS |
| unparseable-duration | WARN |
Framework mappings
- NIST SP 800-53
- AC-2, AC-2(3), PS-7, SA-9
- CIS M365 Benchmark
- 1.1.3