r/msp • u/KrankyYankee • 3d ago
Anyone using two tenants: Internal for email/Teams and second for GDAP/CSP?
Microsoft and CIPP both say to use two tenants to properly manage GDAP. One is your "daily driver" for Teams, email, sharepoint, etc. The other is your GDAP tenant that is only used to manager clients tenants. However, neither can say HOW to set that up if you are an existing MSP with one tenant and existing CSP relationship with Microsoft.
We have our main tenant we use for everything including managing licenses for clients. We do NOT have any GDAP relationships set up in Partner Portal.
Creating a second tenant, getting that configured as a CSP alongside your existing tenant, and using that new tenant for GDAP is the basic process. Making that happen is a deeply hidden secret it would seem. CIPP support says its really up to Microsoft and if the people you work with are willing/able to help.
I've reached out to Pax8, Microsoft, and CIPP and still don't have a clear idea how to do this. Anyone go down this path and know the way?
I did have a call with someone from Microsoft and she said the next step would be to create the second tenant. However, now as I try to do that I have three options: Entra ID and create a Workforce tenant, our CSP Partner Portal, or completely separate from our existing tenant and directly from the M365 website as a clean independent tenant.
6
u/BrorBlixen 3d ago
We stood up a Microsoft Direct tenant and migrated the company accounts over to it. We maxed out our internal use licenses and buy additional licenses via direct bill. My understanding is that as a Microsoft CSP partner you can either buy direct or buy from a third party CSP that you do not have a reseller relationship with.
5
u/unavoidablefate 3d ago
Use a subdomain for your GDAP CSP.
2
u/KrankyYankee 2d ago
This is not something we considered but extremely sensible. Thanks, I’ll check on that.
•
4
u/variableindex MSP - US 3d ago
You set up one tenant (MSP) as Microsoft AI Cloud Partner Program, set up tenant two (CSP) as an indirect reseller using your MPN location ID from MSP tenant.
Optionally, you can link the tenants in the Microsoft partner portal if you want but it’s not necessary.
You can then use solutions designation or the other paid tiers to get your M365 licensing benefits in your MSP tenant so you’re not buying licensing at all.
2
u/decr0ded 3d ago
Whoa, does this work? Tenant one holds the main aicpp membership and the partner mpn id, and tenant two holds a location mpn id? This is sufficient for tenant two to manage gdap after verification happens?
5
u/variableindex MSP - US 2d ago
Yes, it does work and as of today is the recommended best practice. Your MSP tenant gets all the “credit” for what the CSP tenant is selling.
Employees link their Microsoft Learn profiles to MSP tenant for solutions designation.
3
2
u/GeekBrownBear MSP - Orlando, FL 3d ago
We kinda are but cheating at that game. GWS internally and M365 for GDAP/CSP.
For the migration you have two avenues: migrate internal to a new tenant or migrate CSP to a new tenant.
Migrating your own stuff is up to you and you can make it work if the process isn't annoying for everything that would change.
Migrating CSP is up to Microsoft support. So I would try that first but YMMV. For what you mentioned, your third option is the only valid one IMO.
I don't know how the partner benefits work, but they are just product codes so I guess you could use them in the other tenant? but super IDK.
2
u/insightrecon 3d ago
Of your three options, I’d go with the clean signup from the M365 site. The Partner Portal one creates a customer tenant under your own CSP. The Entra one makes whoever creates it Global Admin of the new tenant, so you start with an account from one tenant holding the keys to the other, which is what you're wanting to do.
+1 to the people saying move your internal stuff instead of the CSP. The CSP move is the part only Microsoft can do and you’ve already seen how that’s going. You don’t have any GDAP relationships yet so there’s nothing on the partner side to break. Biggest pain is the domain. It can only be verified in one tenant at a time so you’ll need a cutover window for mail.
Once it’s split, strip the partner tenant down to a few admin accounts with phishing-resistant MFA and nothing else. If techs are still reading email in there you’ve just moved the problem.
1
2
u/lsumoose 3d ago
Should have done it from the start that way, not sure how to change that. Sign up for completely separate 365 account from scratch on the main 365 sign up page is how we did it from the beginning.
7
u/roll_for_initiative_ MSP - US 3d ago
Should have done it from the start that way
That was not always the recommendation or a thing and many providers have had a single tenant + partnership for like 20-30 years now. If you go with the recommended split tenant advice, you have to make the transition OP is talking about sometime.
3
u/KrankyYankee 3d ago
The MSP is over 10 years old and GDAP wasn't a thing back then. The path forward for older MSPs is very murky.
3
u/roll_for_initiative_ MSP - US 3d ago
The path forward for older MSPs is very murky.
and fraught with danger, hassle, and expense for little return :(
1
u/No_Memory_484 3d ago
We have dedicated admin accounts in another tenant different from our normal business stuff. We treat our internal systems like customer systems basically and we only manage stuff from this dedicated tenent. Our normal day to day accounts don’t have admin rights for much of anything. We protect the shit out of our admin account tenant. It’s treated as sacred.
1
u/wulfmulf 3d ago
Why are Microsoft and CIPP saying this is best practice?
5
u/gumbo1999 3d ago
Because if your LOB tenant is compromised, there’s a chance all of your GDAP tenants will fall with it..
4
u/saspro_uk MSP - UK 3d ago
Supply chain attacks.
MSP’s are a target because of the access to other systems we have.
Imagine a tech has access to all your customers, if that 1 tech gets compromised then the attacker gets access to all your customers (probably as admin).It’s happened a few times in the past years to various MSP’s
2
u/ShaneDoesIT 1d ago
I have a seperate admin account with yubikey MFA I use for accessing CIPP and GDAP. Is this suitable rather than a seperate tenant?
2
u/KrankyYankee 3d ago
GDAP is the way to manage clients. A second tenant with access limited to techs who need access and securing those accounts with JIT, CA, PIM, FIDO 2 MFA, and other acronyms makes sure it’s very very secure.
1
1
u/superslowjp16 3d ago
I’d imagine it’s because GDAP on your regular account causes all sorts of headaches that aren’t immediately apparent to navigate
1
u/TechnologyMatch 3d ago
if you're juggling 2 tenants for email and Teams, set up Azure AD B2B or cross-tenant mail routing so users can share mail and chat without extra logins. just like a multiverse portal from Stranger Things, works best with the right licenses, DNS records and clear mail flow rules
1
u/saspro_uk MSP - UK 3d ago
We run 2 tenants for this.
It was easier for us to setup a new tenant for email etc, migrate domains & data to it and leave CSP on your old one.
Join the partner program on the new tenant then merge partners with MS.
Then you can claim all the licenses on the new one (at renewal time) and carry on.
Beats transferring hundreds of clients over.
1
u/KrankyYankee 3d ago
We do not have any clients with GDAP set up and none in the partner portal. We do use Pax8. Would you still use the new tenant for email etc?
1
u/saspro_uk MSP - UK 3d ago
How do you access customer tenants?
Customers should show in your partner centre so usage is attributed to yourselves for incentives/designations.1
u/KrankyYankee 2d ago
Admin accounts in each tenant.
1
u/saspro_uk MSP - UK 2d ago
Definitely should be using GDAP then.
Tenant level admin accounts is something MS advise against doing in their docs (it’s also a pain to audit as you get bigger).
1
u/drew-minga 3d ago
My company has it this way. Primarily because we have cell service and residential home fiber service lines of business. Keeps everything segmented and compliant with all the different regulations.
1
u/mdredfan 3d ago
I first thought about doing this around 3-4 years ago but could never wrap my head around the process for an existing partner tenant.
1
u/Emergency_Recipe522 3d ago
I can see why this is frustrating. Creating a second tenant is the easy part; moving to a new administrative model without disrupting existing customer relationships is the real challenge. I'd get written confirmation of how the existing CSP relationship, subscriptions and customer associations will be handled before making changes. I'd also separate the identity and access design from the actual transition process. The last thing I'd want is to discover halfway through that the new tenant can't manage existing customers.
1
u/decr0ded 2d ago
I am researching a way to do this that doesn't require a second CSP registered tenant. It is called Entra Tenant Governance and it just entered preview in August. I think it is a foundation for the new Defender XDR multi-tenant organization functionality, and part of the broader move to the USOP and of Sentinel moving to Defender. Early days, but it seems like Tenant Governance is meant to extend GDAP style management to multi-tenant organizations that aren't necessarily CSPs.
https://learn.microsoft.com/en-us/defender-xdr/governance-relationships
https://www.cloud-architekt.net/tenant-governance-relationship-cross-tenant-delegation/
https://blog.sebastianwild.net/blog/microsoft-entra-tenant-governance-a-deep-dive-into-the-ga-release/
1
u/ManufacturerAwkward9 2d ago
Yes.
My partner tenant is separate from my daily use tenant, which is GCC.
1
u/dano5 2d ago
You're not allowed to deliver licenses to your own production tenant, CSP tenant should be separate and your production tenant should be direct billing or using one of the benefit packages.
I've seen companies loose their CSP access if they're not compliant on this.
as explained on this page:
https://learn.microsoft.com/en-us/partner-center/enroll/csp-supported-partner-relationships
you either migrate your environment out into a new tenant or move your csp partnership into a new tenant and redo GDAP on all customers.
1
u/Turbulent-Profit-814 1d ago
We have 7 tenants, 1 primary tenant for actually company and 6 for our 6 markets. You can’t have your primary tenant as a direct bill or indirect
•
u/necroarch 20h ago
the clean M365 signup seems like simplest route based on these replies. Getting Microsoft to confirm tenant and CSP migration steps before making chnges should help avoid headches. Curious if TrustedTech has dealt with kind of setup too...
•
u/arsonislegal 16h ago
Best reason to do this is if MSFT locks you out of one tenant randomly, you can hopefully use the 2nd to get support. lol.
•
u/PSCSmoke 15h ago
Your internal 365 shouldn't qualify for csp. And with lighthouse in the azure portal linked to your internal then you can create csp contract tenants (per customer requirement) with subscriptions for that csp tenant. And the lighthouse can give you control plane access to the csp tenant, but no data plane access. (you have to remote invite or create tenant specific accounts for that)
The tenant linking options are if you want direct data plane access... And as a former msp tech I know that is a dream to be control plane only...
•
u/Proximit-MSP 13h ago
Yup. 2 tenants. Always.
Your CSP distributor should be the ones to support you with this and move everything over. If not, change distributor. You can DM though if you really are stuck with no one to help. I'll show you how to do it.
Good luck!
•
u/KrankyYankee 9h ago
We are with Pax8 and they didn’t know about this and after a few calls and emails said “sorry, can’t help”. I’ll DM you later. Appreciate the help.
•
13
u/Critical_Ad_9784 3d ago
I don't understand however how this suddenly makes it more secure. The second tenant is literally susceptible to the exact same attacks the primary tenancy is. But now you've got two tenancies to manage internally, two locations to stuff around with staff onboarding and offboarding, two tenancies to harden and monitor for drift etc
Why not just apply all the proper resources to your existing tenancy to secure it?
An MSP hardening their own tenancy will present less risk than the client who ignores most advice and doesn't have a clue what a phishing email looks like.
Now when I say don't understand, I get the principal for this - I understand why, but it's a level of complexity that really isn't necessary when you harden your own tenancy properly.