Converse agora com nosso suporte
Chat com o suporte

On Demand Global Settings Current - User Guide

Working with On Demand Overview of On Demand Signing up for On Demand Managing organizations and regions Adding users to an organization Managing your Microsoft Entra tenants and on-premises domains On Demand Home page Configuring settings Documentation roadmap Technical Support

Granting and regranting admin consent

You must grant specific admin consents for each On Demand tenant. For example, if you grant access for MyCompany tenant in organization A, and add the MyCompany tenant to organization B, you must grant consent for organization B. In some situations, you might have to regrant consent for an application used by your tenant.

For some consent types, you might also have to assign a role after you grant consent.

Click Tenants in the navigation panel on the left.
If the current status is Not Granted, you can enable the module consent type for this tenant by clicking Grant Consent.
If the current status is Regrant Consent, a change in the required permissions or new functionality might mean that you must regrant consent for a previously granted consent.

For the following scenarios, you would click Grant Consent or Regrant Consent in the Status and Actions column.

The admin consent token for the module expired, resulting is a status of Consent Required. The status of Consent Required indicates that On Demand cannot obtain a token with delegated permissions based on a previously granted admin consent. To restore the interrupted services, you must regrant consent.
A new feature in an On Demand module can require that additional permissions be granted. In this scenario, you would click Regrant Consent. For example, when On Demand implemented the new Microsoft Authentication Library (MSAL) in June 2022, admin consents had to be regranted for modules that use delegated permissions.
Admin consent has been revoked in the Microsoft Azure portal, resulting in a status of Revoked. If you revoke the Core Basic admin consent in the tenant you will see Revoked status for Core Basic and Not Available for all other modules. The Core Basic application is used to determine the consent status for your tenant. If that consent is revoked, On Demand cannot determine consent status for the rest of the modules. Consent might be granted for the modules, but On Demand cannot verify it.

The Microsoft Authentication Library (MSAL) is the recommended library that replaces the deprecated Azure Active Directory Authentication Library (ADAL). MSAL provides improved security, is resilient, and allows tokens to be generated with a very granular scope. Since MSAL supports generated tokens with a granular scope, On Demand can use tokens with a narrowed scope when accessing your tenant.

This feature provides a more secure and granular approach for accessing your data. For more information, see Permissions and consent in the Microsoft identity platform.

For the License Management module, to use Self Server License Reporting, you must grant additional permissions over the Base permissions.

Sometimes, when you grant consent for Self Service License Reporting, you might see an error that indicates that the app requires access to a service that your organization has not subscribed to or enabled. This error occurs if the Microsoft M365 License Manager API, required to gather self-service policy data, is not enabled in the tenant by default. You can resolve the error by enabling the M365 License Manager API in the tenant.

Install the Azure PowerShell Az module if it is not already installed.

After you complete these steps, you can complete the Grant Consent for Self Service License Reporting without errors.

About revoking admin consent

Completely revoking admin consent removes all permissions granted for the On Demand application. Revoking admin consent is a manual process that must be performed in the Microsoft Azure portal.

NOTE: You can revoke or disable consent in the Microsoft Azure Portal.

Revoking admin consent removes all permissions granted for the On Demand application.

Click on the Microsoft Entra ID icon in the left menu.
At the top of the Properties pane, select Delete, and then select Yes to confirm you want to delete the application from your Microsoft Entra tenant.

Alternately, to disable consent, you can disable a user from signing in.

Search for and select Microsoft Entra ID.
Select Enterprise applications.
Select Properties.
Select No for Enabled for users to sign-in?.
Select Save.

Removing a tenant

By removing a tenant, you are beginning the process of disabling all module functions related to the tenant. When you remove a tenant, you are removing the tenant from the On Demand organization for all users and this action cannot be undone.

All module operations will stop after 30 days. At that point, the following operations are halted:

You must provide the tenant name, your organization ID, and the tenant region.

Click Tenants in the navigation panel on the left.
Click Remove Tenant.

When you previously added the tenant, a Service Principal was created in your tenant, under Enterprise applications, for each consent that you granted for this tenant. To remove the consents, log in to the Microsoft Azure portal and go to the Microsoft Entra Admin Center. Browse to Enterprise Applications, search for Quest on Demand -, and delete all the application records that you do not need.

Managing your on-premises domains

In addition to managing your Microsoft Entra tenants, On Demand provides support for connecting to on-premises domains in hybrid environments to perform data collection and management activities.

By installing an agent with a unique key and specifying domains to which the agent is connected, you can review information and perform actions in your hybrid environment. You start the process to install and configure an agent by selecting Tenants in the left navigation bar and selecting Hybrid Agents.

You can add on-premises domains to On Demand selecting Tenants in the left navigation bar and selecting Active Directory Domains. You can also add domains as part of the agent configuration process.

You must meet the following prerequisites to download and install an agent for on-premises data collection from specified domains:

The agent setup program will prompt you for service account credentials (username and password) that are used to run the agent service. The agent service account must be a domain account and must have local administrator rights on the computer on which the agent is being installed. Also, for License Management, the service account must have Write Members permissions on the directory group objects.

Documentos relacionados

The document was helpful.

Selecione a classificação

I easily found the information I needed.

Selecione a classificação