Can I grant my CSP partner temporary admin access without giving up full control?

Yes — this is exactly what Granular Delegated Admin Privileges (GDAP) is designed for. You can grant a partner specific, limited roles (rather than full Global Admin) and set an expiration date on that access, so it automatically ends rather than persisting indefinitely.

This lets you get hands-on help for a specific project (like a migration or a configuration task) without handing over broad, permanent control of your tenant.