Regranting consent is required for On Demand Applications will be required on or before June 21st 2022 (4255311)

Regranting consent is required for On Demand Applications will be required on or before June 21st 2022

Microsoft announced in Build Conference 2020 that they will be deprecating Azure Active Directory Authentication Library (ADAL) initially planned for June 2022 and now extended to the end of the year. Microsoft has recommended everyone to migrate to Microsoft Authentication Library (MSAL). Our On Demand applications use the ADAL to request and to provide the necessary consents for the applications to function correctly. 

Due to this change an On Demand Administrator must perform a one-time action in the On Demand user interface to regrant Admin consent.

1. Microsoft is deprecating the Azure Active Directory Authentication Library (ADAL) and it is being replaced by the Microsoft Authentication Library (MSAL) which provides better security and resilience
2. The Quest On Demand Tenant Consents page is being updated to use MSAL and provide new functionality for consent versioning and tracking
3. For Quest On Demand applications with delegated permissions, you must regrant consent due to the migration to MSAL

You can now log in now to On Demand, switch to the new consent experience, and regrant consent (Global Administrator permissions are required when you grant consent for tenant access). On June 21st 2022, all customers will be automatically switched to the new consent experience and must regrant consent.

• What happens if I don’t do anything?
  Customers using On Demand applications that rely on delegated permissions (such as On Demand Migration, Recovery, License Management, and Group Management) will begin to see failures in these applications and services if they do not regrant consent before June 21. Backend services supporting these activities in On Demand will stop working until the consent is regranted.
• What actions do I need to perform to make this seamless?
  Before June 21, the On Demand Admin should log into On Demand, switch to the new consent experience, and regrant consent to the relevant applications they want to use with the respective On Demand services. (Global Administrator permissions are required when regranting consent for tenant access).
  • If consent is not regranted before June 21, migration tasks that were started before this date will continue to migrate, but any new tasks can't be started until consent is regranted.
• Quest On Demand Dashboard Notification
  Before June 21, there will be a notification message on the On Demand dashboard to tell you about the upcoming consent changes and to provide the ability for you to switch to the new experience immediately.

• Quest On Demand - Recovery - Basic
• Quest On Demand - Recovery - Teams
• Quest On Demand - Migration - Teams
• Quest On Demand - License Management - Self Service License Reporting
• Quest On Demand - Group Management

1. Login to Quest On Demand
2. Click and follow the instructions

The Microsoft Authentication Library (MSAL) is the recommended library that replaces the deprecated Azure Active Directory Authentication Library (ADAL). MSAL provides improved security, is resilient and allows tokens to be generated with a very granular scope. Since MSAL supports generated tokens with a granular scope, On Demand can use tokens with a narrowed scope when accessing your tenant. For example, suppose an On Demand solution only needs to access a subset of resources such as a user object. Currently, the On Demand solution can access more than the user object including objects such as groups, calendar, and so on. MSAL provides the ability to limit the "scope" when a token is requested. In other words, if an On Demand solution needs to access user objects only, it can request a token with only this permission for the resource in the token. Even if consent is granted for all five permissions in the resources, the current token module is limited to one permission. This feature provides a more secure and granular approach for accessing your data. For more information, see Permissions and consent in the Microsoft identity platform.