Updated September 18, 2025
This is an amendment to our initial notification on August 17, 2025, related to new permissions that will be added to the On Demand Recovery Basic and Restore applications. Permissions for the Basic and Restore applications have been updated since the initial notification. The new permissions will be added one week from date of this amendment.
To accept these new permissions, consent will need to be re-granted for your organization.
What is changing and why?
On Demand Recovery will be introducing a new feature to back up and restore organization settings for a tenant.
To perform a backup operation, the following new permissions will be added to the Basic application:
Organization.Read.All – Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information.
User.Read.All – Allows the app to read the properties of the insights Settings object for displaying or returning people insights in an organization, on behalf of the signed-in user.
NOTE: Both permission types are delegated, and the Global Reader role is required for the user who grants consent.
Once the feature is released, re-granting consent for the On Demand Recovery Basic application may be required to maintain continued backups. To perform a restore operation, the following new permissions will be added to the Restoreapplication:
Organization.ReadWrite.All– Allows the app to read and write the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information.
PeopleSettings.ReadWrite.All– Allows the application to read and write tenant-wide people settings on behalf of the signed-in user.
Re-granting of consent to the On Demand Recovery Restore application is only required for the new restore functionality. Existing restore operations will continue to operate as usual.
Action Required:
Once the new feature for backing up and restoring organization settings is released, it may be necessary to re-grant consent to the On Demand Recovery Basic application for continued backups. Please ensure that a privileged account with Global Administrator permissions has been provisioned in preparation of the re-granting of consent for the Basic application.
For the One Demand Recovery Restore application, no immediate action needs to be taken. However, please ensure that a privileged account with Global Administrator permissions has been provisioned in preparation of the re-granting of consent for the Restore application to use the new restore feature for organization settings. Existing restore operations will continue to operate as usual without re-granting of consent.
The status and consent version for the Basic and Restore applications will indicate when the new permissions are available. New permissions will be added to consent version 2.4 for the Basic application and consent version 1.9for the Restore application. To check the consent version, in On Demand, go to the “Office 365 Tenants” tab on the “Tenants page”, select “Edit Consents” on the tenant tile, then select “View Details” under “Status and Actions” for Restore.
