On Demand Global Settings Current - User Guide

Managing admin consent permissions

Once you add a tenant, you are redirected to a page that lists the permissions that will be granted. You must click Accept and provide admin consent for the On Demand application. Once the Global Administrator adds a tenant to On Demand, an application record is created in the tenant indicating that admin consent has been provided.

NOTE: Global Admin credentials are only required to grant admin consent for the minimal list of permissions required by On Demand. Global Admin credentials are not stored, shared, or used for any other purpose.

When you first add a tenant, only the minimum permission settings are granted. Some modules require additional permissions for specific activities. Once a tenant has been added to On Demand, you can grant additional permissions on the Tenant Consents page.

To open the Tenant Consents page, click Tenants in the navigation page and click Edit Consents on the tenant tile.

You can view the specific permissions for each On Demand application by clicking View Details. You can also see the last time that consent was granted and which On Demand user granted the consent.

About admin consent status

On the Tenant Consents page, you can view admin consent status for various applications used by On Demand modules for each tenant that you have added. The process of granting access to the customer Microsoft Entra tenant by the tenant global administrator is referred to as admin consent. A Microsoft Entra tenant global administrator must provide consent to any application listed on the page. Each application on this page defines the set of permissions required to provide a specific module functionality.

When a tenant is first added, the user is requested to grant admin consent for the Basic application. Other modules require a higher level of permissions.

Following best practices for SaaS applications, On Demand applications use OAuth 2.0 and OpenId Connect protocol and authentication library for the Microsoft Identity Platform to configure and request access to protected resources in customer tenants. All On Demand applications described on the Tenant Admin Page are configured in Microsoft Entra ID as multi-tenant confidential applications (https://learn.microsoft.com/en-us/entra/identity-platform/application-model#multitenant-apps).

Some On Demand modules require that a role be assigned to the service principal in addition to admin consent grant. The role is needed to support specific module functionality. For example, after granting consent for the Exchange Online PowerShell consent type, you must assign the Exchange Admin Role. This role is needed to perform Exchange tasks such as linking mailboxes to users and deleting mail-enabled groups.

Granting and regranting admin consent

You must grant specific admin consents for each On Demand tenant. For example, if you grant access for MyCompany tenant in organization A, and add the MyCompany tenant to organization B, you must grant consent for organization B. In some situations, you might have to regrant consent for an application used by your tenant.

For some consent types, you might also have to assign a role after you grant consent.

NOTE: If you assign a role and immediately refresh the page, the Assignment state might be displayed as "Not Assigned" for a short time until you refresh the page again.

NOTE: If additional admin consent permissions are required to perform specific tasks within a module, these consent types are listed below the core or basic consent type for the module.

For the following scenarios, you would click Grant Consent or Regrant Consent in the Status and Actions column.

The Microsoft Authentication Library (MSAL) provides improved security, is resilient, and allows tokens to be generated with a very granular scope. Since MSAL supports generated tokens with a granular scope, On Demand can use tokens with a narrowed scope when accessing your tenant.

This feature provides a more secure and granular approach for accessing your data. For more information, see Permissions and consent in the Microsoft identity platform.

For the License Management module, to use Self Server License Reporting, you must grant additional permissions over the Base permissions.

Sometimes, when you grant consent for Self Service License Reporting, you might see an error that indicates that the app requires access to a service that your organization has not subscribed to or enabled. This error occurs if the Microsoft M365 License Manager API, required to gather self-service policy data, is not enabled in the tenant by default. You can resolve the error by enabling the M365 License Manager API in the tenant.

After you complete these steps, you can complete the Grant Consent for Self Service License Reporting without errors.

About revoking admin consent

Completely revoking admin consent removes all permissions granted for the On Demand application. Revoking admin consent is a manual process that must be performed in the Microsoft Azure portal.

NOTE: You can revoke or disable consent in the Microsoft Azure Portal.

Revoking admin consent removes all permissions granted for the On Demand application.

Alternately, to disable consent, you can disable a user from signing in.