License & Subscription Issues

How to Purchase Microsoft Office E3 Licenses Without Broad Admin Access

Maira Mehtab Sep 28, 2026 869 views

Question details

The user wants to buy Microsoft Office E3 licenses via a reseller but needs to restrict the reseller's administrative access to organizational data and users.

Product: Microsoft 365
Device & OS: not provided
Scenario: Purchasing enterprise licenses through a Cloud Solution Provider (CSP) or Microsoft Partner.
Observed behavior: The goal is to successfully acquire licenses while maintaining strict data privacy and implementing the principle of least privilege.

Before you start

Ensure you have access to your Microsoft 365 Admin Center with Global Administrator privileges to review and approve partner relationship requests.

Solution 1Recommended

Use Granular Delegated Admin Privileges (GDAP) with Your Partner

Microsoft allows purchasing through partners while strictly limiting their access using Granular Delegated Admin Privileges (GDAP).

By utilizing GDAP, organizations can ensure that a Microsoft Partner only receives the specific, minimum permissions required to provision licenses, completely preventing unauthorized access to emails, files, or unrelated user data.

Initiate the license purchase

Contact your chosen Microsoft Partner or Cloud Solution Provider (CSP) to initiate the Office E3 license purchase and explicitly state your security requirements.

Request a GDAP relationship

Ask the partner to send a Granular Delegated Admin Privileges (GDAP) relationship request instead of broad Delegated Admin Privileges (DAP).

Review the partner request

Log into the Microsoft 365 admin center, navigate to the 'Settings' menu, and open the 'Partner relationships' section to review the requested roles.

Approve minimum permissions

Approve the GDAP request only for the minimum necessary roles (such as License Administrator) required to provision the E3 licenses.

Assign licenses internally

Once the licenses are purchased and provisioned by the partner, navigate to 'Users' > 'Active users' in your admin center to manually assign the licenses directly to your employees.

Data Security Maintained: GDAP relationships are highly customizable and time-bound, ensuring the partner's access automatically expires after a set duration.

Solution 2

Contact Microsoft Partner Center Support

If you are unsure about the permissions requested by a reseller, consult Microsoft support for guidance on CSP access.

Free Microsoft Office alternative

Try WPS Office for a Cost-Effective and Secure Enterprise Solution

If managing complex Microsoft 365 licenses and administrative permissions is becoming a burden for your organization, consider WPS Office. It provides a lightweight, highly compatible alternative to Microsoft Office without the complicated enterprise licensing and partner access models.

1. Download the software: Visit the official WPS Office website and click the free download button for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the straightforward on-screen instructions to deploy the suite on your computer.
3. Work seamlessly: Launch WPS Office and immediately start opening, editing, and saving your existing Microsoft document formats natively.

Fully compatible with Microsoft Office formats (Word, Excel, PowerPoint).No complex granular admin setups required for deployment.Significantly more cost-effective than standard enterprise licenses.Lightweight installation and straightforward user management.

microsoft office alternative - wps office

Frequently Asked Questions

What is GDAP in Microsoft 365?

Granular Delegated Admin Privileges (GDAP) is a security feature that allows organizations to grant Microsoft Partners restricted, time-bound access to their Microsoft 365 tenant, ensuring partners only have the specific permissions needed to perform their tasks.

Can a Microsoft Partner access my users' emails if they sell me licenses?

Not if you restrict their access properly. By using GDAP and denying sensitive roles like Exchange Administrator or Global Reader, you can ensure the partner cannot read organizational emails or access user files.

How do I assign the Office E3 licenses after the partner provisions them?

Once the partner completes the transaction, log into the Microsoft 365 admin center, go to 'Users', then 'Active users'. Select the target user, navigate to the 'Licenses and apps' tab, and check the box next to the new Office E3 license.

Login & Account Issues