Microsoft Entra bulkJobs authentication failure when exporting users or group members through GDAP

Hello everyone,

I'm looking for guidance on Microsoft's recommended approach when GDAP cannot perform an administrative task that is required for operational support.

Our organisation is moving towards a strict Zero Trust model that prioritises:

• GDAP over customer-owned named accounts
• Least privilege access
• Temporary elevation where required
• Avoiding routine use of shared or break-glass accounts

While supporting a customer tenant, I found an issue with Microsoft Entra bulk exports.

The following operations fail when performed through GDAP:

• Download all users
• Download group members

Findings:

• The GDAP relationship is active.
• The required delegated roles are assigned.
• I can view users and group memberships successfully.
• The same operations succeed when performed using a customer-native Global Administrator account.
• The failure only occurs when the portal submits the bulk export job.

Browser developer tools show the following request failing:
POST https://graph.microsoft.com/beta/admin/entra/bulkJobs

Response:
{

"error": {

"code": "AuthenticationError",

"message": "Error authenticating with resource."

}

}

This behaviour is reproducible for multiple Entra bulk export operations, not just a single workload.

My questions are:

 1. Is this a known limitation of GDAP or the Entra Bulk Operations service?
 
    1. If GDAP cannot perform a required administrative function, what is Microsoft's recommended approach?
    
       1. Does Microsoft consider customer-owned named administrative accounts an acceptable fallback for verified GDAP limitations?
       
          1. What is Microsoft's recommended balance between:
          
                - GDAP and least-privilege administration
                
                      - customer-native named accounts
                      
                            - emergency/break-glass access
                            

Our goal is to align with Microsoft's Zero Trust recommendations while ensuring engineers can still perform all operational support activities.

Any guidance, best practices, or relevant documentation would be greatly appreciated.

Thank you.