Skip to main content

Overview

The MSP Process platform can reset M365 users’ passwords, reset their MFA methods, and reset their accounts, all from within the MSP Process pod/Insight. To do this, an Enterprise Application must be deployed into each M365 tenant. The fastest and most repeatable way to deploy it is to use the Admin Relationships you’ve already set up through the Microsoft Partner Center. This article walks you through the required steps. If an end-user can’t verify their own identity before a reset, for example because they’ve lost the phone they use for Microsoft Authenticator, you can verify them through their manager or a designated point of contact using the manager approval method, covered below.

Where You Can Perform Identity Management Actions

You can reset an end-user’s password, MFA, or account from any of these locations:
  1. The Contacts and PSA Tickets pages of https://app.mspprocess.com
  2. The ConnectWise and HaloPSA pod
  3. The Autotask and FreshService Insight
  4. The browser extension used by SuperOps/Syncro and Kaseya BMS partners

This article provides instructions for setting up and deploying M365 Identity Management. If M365 Identity Management has already been successfully deployed and you’re looking for guidance on how to use its available features, please see Self-Service Password Reset (SSPR), MFA Reset, and Unlocking User Accounts.

Prerequisites

  1. You must have Admin Relationships set up in the Microsoft Partner Center with each M365 tenant you want to link to MSP Process.
  2. Those Admin Relationships must include the Application Administrator, User Administrator, and Authentication Administrator Entra roles.
  3. Each of those roles must be assigned to a Security Group.
  4. Ideally, use a dedicated group for each role, such as “GDAP - Application Administrator”, “GDAP - User Administrator”, and “GDAP - Authentication Administrator”.
  5. The Microsoft user account you’ll use during setup must be a member of all three Security Groups in M365.

Linking MSP Process with Microsoft 365

  1. Log in to the MSP Process UI.
  2. Navigate to Settings → Integrations → Security Integrations.
  3. Click the Add new integration button.
  1. Click the Identity Management option.
  1. Click the Connect through the Microsoft Partner Center button.
  1. In the pop-up window that appears, click the Link for Redirect URI button.
  1. Keep the MSP Process window open. In a separate browser tab, log in to https://portal.azure.com.

Configuring the Integration for a M365 Cloud Solution Provider (CSP) Environment

NOTE: The Admin Relationships you’ve established with your clients’ M365 tenants must have the Application Administrator, User Administrator, and Authentication Administrator roles assigned. If Authentication Administrator is missing, password and account resets will still work, but MFA resets will fail.
  1. Log in to your Microsoft Azure portal (https://portal.azure.com).
  2. Navigate to App Registrations.
  1. Add a new App Registration.
  1. Configure it as follows. The URI will vary depending on the ID of your M365 integration.
  2. Name: MSP Process Identity Management App (GDAP)
  3. Supported Account Types: Multiple Entra ID tenants; choose the Allow all tenants radio button
  4. Redirect URI: Web; URI: the URI you just copied from MSP Process
  1. Within the App Registration you just created, go to Manage → API Permissions
  3. Assign the app the following permissions.
  1. NOTE: For the Partner Center’s user_impersonation permission, there are two identically named permissions. To save yourself a headache, search for the following application ID to bring up the correct one:
  2. **fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd**
  3. Within the App Registration, navigate to Manage → Certificates & Secrets.
  5. Give your secret a name and we recommend setting the “Expires” to the longest length.
  1. Add a new Client Secret.
  1. Copy the Client Secret Value, not the ID, because you’ll need it in a moment.
  1. In MSP Process, return to the Identity Management pop-up window you opened earlier and enter the required information:
  2. The Tenant ID of your M365 CSP tenant
  3. The Application ID of the app you just registered, found on the Overview page of the App Registration
  1. The Client Secret from step 10
  1. Click Submit.
  2. When prompted, enter your Microsoft credentials.
  3. Once you’re returned to the MSP Process UI, wait 1–2 minutes, then click the Identity Management card. You’ll see your Partner Center-linked tenants.

To review how to apply the Password and MFA Resets or Unlocking a user’s account, please review Self-Service Password Reset (SSPR), MFA Reset and Unlocking User Accounts.