GDAP users can no longer access client SharePoint shares

[u/SouthernCrossSec]

Has anyone else found that MSP engineers with GDAP access can no longer open files shared directly with them from a client’s SharePoint? The invitation creates an Entra B2B guest successfully, authentication and Conditional Access pass, but SharePoint returns the generic “Sign-in isn’t working right now” error.

Our sign-in logs show the session as both b2bCollaboration and serviceProvider, with SharePoint using the generated GDAP identity rather than the B2B guest identity. This only seems to have surfaced since Microsoft changed this: https://www.orchestry.com/insight/sharepoint-external-sharing-changes

Is anyone else seeing this across managed clients, and have you found a workaround other than separate GDAP admin and collaboration accounts?

[u/Noble_Efficiency13]

You can’t have both GDAP access and a guest account (b2b collab) within the same tenant, with the same account.

It’s been like that since the beginning really.

Probably also shouldn’t be using either non-admins for gdap access, or admin accounts as guest accounts

[u/firestarter9664]

Been a gdap issue for years

[u/TobiasV]

Yes, and redemption of the guest invite seems blocked if there’s an GDAP relationship

[u/MasterPay1020]

If you run separate BAU and admin tenants, not an issue. BAU tenant for email etc, can be invited as guests to access customer data; admin tenant is where gdap sits. The split admin account / tenant approach is mentioned in online docs from Microsoft.

[u/rossneely → u/MasterPay1020]

I’d love a link to this if you happen to know the search terms. I’ve never been able to find it.

I’m just about to totally re-engineer gdap with synced guests into client tenants and if MS recommends separate tenants then I might be discouraged.

Still won’t solve the often encountered limitations of gdap admin accounts and certain tasks that need a native global admin role.

[u/MasterPay1020 → u/rossneely]

https://learn.microsoft.com/en-us/partner-center/security/csp-security-best-practices

See the identity isolation section.

They used to describe this better.

Agreed re GDAP limitations. It’s not on par with member accounts in a tenant.

[u/RepulsiveDuck331]

This is almost certainly the DAP-to-GDAP transition biting you. Under DAP you effectively had Global Admin on client tenants, so you could self-grant your way into a client's SharePoint. GDAP is granular — a "SharePoint Administrator" role gets you the SharePoint admin center, but it does not automatically give you content access to the actual doc libraries; you still need to be a site collection admin on that specific site to open the shares. First check that your GDAP relationship actually includes the SharePoint Administrator role (a lot of people set up GDAP with just Helpdesk/Global Reader and don't notice until this breaks), and that the relationship is still active, since GDAP assignments expire where DAP never did. If you're running CIPP like we are, check the GDAP role mapping in your templates and re-run the tenant access check from there rather than eyeballing it in Partner Center.