Chat now with support
Chat with Support

On Demand Global Settings Current - User Guide

Working with On Demand Overview of On Demand Signing up for On Demand Managing organizations and regions Adding users to an organization Managing tenants On Demand Home page Settings Documentation roadmap Technical Support

Adding a tenant

When you add a tenant, you must have Global Administrator credentials in Microsoft Azure since part of the process of adding a tenant is done in the Microsoft Azure portal.

Prerequisites

Admin consent is required to add a tenant to On Demand. Since only an Azure Global Administrator can grant admin consent, you must be able to provide Azure Global administrator credentials for the tenant you are adding.

To add a tenant
1
Log in to On Demand using the credentials you used to sign up for On Demand.
2
In the navigation panel on the left, click Tenants.
3
On the Tenants page, click Add tenant.
You are redirected to the Microsoft login page.
4
Enter your Azure AD Global Administrator credentials and click Next.
A page opens with the list of permissions that you are granting.
5
Click Accept.
The On Demand Tenants page is displayed.
6
On the Tenants page, at the bottom of the tile for the newly added tenant, click EDIT CONSENTS.
The Admin Consent status page opens.
7
If the minimum permission settings granted when the tenant was added are sufficient for a module, the Status for the module is Uses Base. If the module requires additional permissions, the Status is Not Granted.
If you need to have additional permissions for a module, click Grant Consent. You are redirected to the Microsoft login page.
8
Enter the Azure AD Global Administrator credentials and click Next.
A page opens with the list of permissions settings you are granting.
9
Click Accept.
The On Demand Tenants page is displayed.

Managing admin consent

•
Admin consent status
•
Granting consent
•
Revoking admin consent

Admin consent status

To open the Admin Consent status page, click Tenants in the navigation page and click EDIT CONSENTS on the tenant tile.

On the Admin Consent status page, you can view the module admin consent status for each tenant you have added. The process of approving the use of an application for the whole Microsoft Azure AD organization by the Microsoft Global administrator is referred to as admin consent. A Microsoft Global administrator must provide admin consent when adding a tenant to On Demand.

When a tenant is first added, On Demand requests base admin consent permissions. Some modules can function using the base permission set while other require a higher level of admin consent permissions.

To edit admin consent
1
Click Tenants in the navigation panel on the left.
2
At the bottom of a tenant tile, click EDIT CONSENTS.
The Admin Consent edit page for the tenant opens.

The Status information on the tenant tile indicates if admin consent has been granted for a module. If the current status is Not Granted, you can enable a module for this tenant by clicking Grant Consent in the Actions column.

 
* 
NOTE: If additional admin consent permission is required to perform specific tasks within a module, these items are listed beneath the main admin consent item for the module.

Granting consent

For the following scenarios, click Grant Consent in the Actions column.

•
Admin consent has been revoked in the Azure AD portal, resulting in a status of Revoked.
•
The admin consent token for the module has expired, resulting is a status of Token Expired. This can occur if the Azure Global Administrator account used to grant consent has changed (deleted, role change, password change). Note that a Token Expired status is not serious and has a limited impact on On Demand operation.
Prerequisite for Self Service License Reporting access

For the License Management module, to use Self Server License Reporting, you must grant permissions above Base permissions.

Sometimes, when you grant consent for Self Service License Reporting, you might see an error that indicates that the app requires access to a service that your organization has not subscribed to or enabled. This error occurs if the Microsoft M365 License Manager API, required to gather self-service policy data, is not enabled in the tenant by default. You can resolve the error by enabling the M365 License Manager API in the tenant.

You must grant admin consent per On Demand tenant. For example, if you grant access for MyCompany tenant in organization A, and add the MyCompany tenant to organization B, organization B will still require the access grant.

To enable the M365 License Manager API
1
Install the Azure PowerShell Az module if it is not already installed.
2
Run the Connect-AzAccount cmdlet to log into your tenant using an account that has Azure AD administrative rights.
3
Run the following command:
New-AzADServicePrincipal -ApplicationId aeb86249-8ea3-49e2-900b-54cc8e308f85

After you complete these steps, you can complete the Grant Consent for Self Service License Reporting without errors.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating