Microsoft for MSPs

Understand the identities, permissions, connections, and mappings behind multi-customer Microsoft automation in Bifrost

Bifrost can manage Microsoft 365 customer tenants with a provider-owned Graph identity and deploy a shared Microsoft Teams app package across those tenants. Optional Microsoft CSP workspace automation can add Partner Center and GDAP operations. It is not a Bifrost built-in and it is not a prerequisite for Teams.

This guide explains the architecture before you create credentials or grant permissions. Start with discovery: ask what is already configured, offer to inventory it read-only, and recommend whether to reuse, repair, or create each component.

Discover Before You Configure

Inventory the provider tenant, Partner Center account, Entra applications, service principals, Graph grants, GDAP relationships, provider security groups, Bifrost integrations and mappings, Teams packages, event sources, and dependent workflows. Do not inventory secrets themselves.

For each component, return:

Decision	Meaning
`reuse`	Healthy, understood, appropriately scoped, and safe to share with its known consumers
`repair`	Correct identity or resource, but missing owners, permissions, mappings, consent, or verification
`create`	Missing, unsupported, unsafe to reuse, or coupled to an unrelated system

The Microsoft setup assistant contains a reusable discovery prompt.

The Three Control Planes

Control plane	What it controls	Typical Bifrost connection
Partner Center	Customer discovery, reseller relationships, and partner operations	Optional `Microsoft CSP` workspace app and workflows
Microsoft Graph and Exchange Online	Users, groups, licenses, mail, Teams app installation, and other tenant resources	`Microsoft`
Teams bot service	Incoming Teams activities and outgoing bot messages	`Microsoft Teams Bot`

When present, the CSP workspace automation uses its Partner Center app-and-user identity. Keep it separate from the Graph app-only identity and the Teams bot identity: they use different authentication flows, permissions, and operational lifecycles.

Identities and Tenant Mappings

A provider installation has four important identifiers:

Identifier	Meaning	Scope
Partner tenant ID	The Microsoft Entra tenant that owns the CSP relationship	Provider
Customer tenant ID	The customer’s Microsoft Entra tenant	Customer
Bifrost organization ID	The organization that owns customer-scoped runs and data	Customer
Teams catalog app ID	The ID assigned to the uploaded Teams app package in a customer’s catalog	Customer app installation

The customer tenant ID is the stable key that joins Microsoft to Bifrost. Store one unambiguous mapping from each customer tenant to its Bifrost organization. Teams app catalog IDs are tenant-local values and should be stored as metadata on the same customer’s Teams mapping.

What Can Be Automated

Task	Automation boundary
Create or update a provider-owned Entra application	Microsoft Graph can automate this when the operator has the required directory role and Graph permissions.
Add API permissions to an application	Microsoft Graph can update `requiredResourceAccess`. Granting tenant-wide consent is a separate privileged action.
Discover CSP customers	Partner Center APIs can list customers after the provider completes its own interactive connection.
Create GDAP relationships and role assignments	Optional CSP workspace automation can use Microsoft Graph GDAP APIs for most of the lifecycle. Customer approval may still be required.
Create a customer service principal and grant consent	Possible through the provider’s approved CSP/GDAP consent process when the relationship and roles permit it. Record the grant and verify it in the customer tenant.
Upload a custom Teams app to a customer catalog	Microsoft Graph supports delegated catalog publishing. Application-only publishing is not supported. An authorized user or Teams admin may need to perform this step.
Install or upgrade the provider’s Teams app for users and teams	Microsoft Graph supports proactive installation after the package exists in the customer catalog. Use self-scoped installation permissions where possible.
Receive Teams messages	The public Bifrost event source validates Bot Framework requests, then a routing workflow maps the activity tenant to a Bifrost organization.
Reply or send proactive messages	The bot sends through the Bot Connector service using the conversation reference returned by Teams. Graph is used for discovery and app installation, not ordinary bot replies.

Microsoft’s Secure Application Model requires an interactive partner connection with MFA and secure refresh-token storage. If optional CSP workspace automation is present, store that connection as an integration rather than asking workflows to manage raw tokens.

The Bot Framework adapter authenticates the bot application, while the routing workflow reads the tenant from the authenticated native event and resolves its Bifrost organization. Treat provider-wide app packaging, proactive deployment, and inbound activity routing as separate concerns when planning a multi-customer rollout.

Permission Design

Grant permissions by capability, not by copying a long permission list from another provider.

Start with the smallest profile that supports the workflows you plan to install.
Keep delegated and application permissions separate in your review.
Use GDAP roles for provider-side delegated administration and provisioning. They do not add authority to an already-consented app-only Graph token.
Treat Exchange Online application access as an optional capability with its own role and review.
Treat Teams chat history and resource-specific consent (RSC) as optional. Bot messages and replies do not require broad chat-read permissions.
Reconcile configured permissions against actual workflow usage on a schedule.

Optional CSP workspace automation can store selected permissions for consistent review and application. A provider should define its own profiles instead of inheriting another MSP’s IDs, groups, roles, or historical permissions.

Recommended Ownership Model

Use one provider-owned Microsoft foundation for shared authentication and mappings. Build optional capabilities on top of it:

Microsoft foundation: integration definitions, provider connection health, customer tenant mappings, and consent records.
Optional CSP and GDAP management: customer discovery, relationship creation, role templates, and consent operations.
Teams bot: bot identity, Teams app package metadata, webhook event source, tenant routing, and messaging workflows.

This boundary matters when packaging Bifrost Solutions. Other apps may use the same Microsoft integration and tenant-status tables. Do not remove or replace shared resources until dependency checks show that every consumer has moved to the foundation Solution.

Evidence to Retain

For each provider and customer, record:

Provider tenant ID and verified Partner Center account
Entra application object ID and application ID for each connection
Granted Graph and Partner Center permissions
GDAP relationship ID, state, expiration, security groups, and role assignments
Customer tenant ID to Bifrost organization mapping
Teams catalog app ID and installed package version
Dates and operators for interactive consent and catalog upload
Results of read, install, inbound-message, and proactive-message tests

Do not store secrets, authorization codes, access tokens, or signed URLs in these records.

Setup Order

Connect Microsoft Graph for app-only customer automation.
Set Up a Shared Microsoft Teams Bot if you need Teams.
Add Microsoft Partner Center and GDAP only when your workspace uses optional CSP automation.
Use the Microsoft Setup Assistant to guide and record the rollout.