SOLVED

3rd party applications in Azure AD

Brass Contributor

We have disabled the feature where users can consent to third-party applications accessing data on their behalf - we have seen it used as a vector for phishing attacks where malicious documents are created in SharePoint and then the users own email account is used to send out sharing requests.

 

As a result, people are now asked for admin approval when attempting to use these applications - the behaviour described here https://docs.microsoft.com/en-gb/office365/admin/misc/integrated-apps?view=o365-worldwide. Where these apps are not in the gallery, the only way to grant access to the whole tenant is to authorise the app as an admin for the user by logging in for them, and then locating the app in the Azure AD portal and granting admin consent for the organisation.

 

This is quite a clunky process, especially where the end user and the admin are not located in the same office or timezone. I can see the attempted sign-ins in the portal - is there no way to initiate an app approval workflow from here once the application ID is known? It's possible I am approaching this in completely the wrong way but the agent who picked up my support request couldn't suggest a better approach than doing a screen share with an affected user to authorise the application either. It seems like a major shortcoming in the service.

7 Replies

Not sure I entirely understand the scenario. Do you really want to consent to an application based only on it's ID, without even checking what the app does, who the publisher is, etc?

 

I do agree that the process can be tiresome, but that's usually the price for having stricter control. And I can tell you that Microsoft is already looking into improving this scenario, look for some news at Ignite.

The scenario is a user attempts to link a 3rd party app to their Azure AD account to access Office 365 data, and they receive a prompt telling them that they need admin approval. They open a support case with us, and we have a look at the application that they are trying to use and decide that it is suitable in terms of what it does, where the company is located etc.

 

As far as I can see, the only way to get that application working is for an application administrator to sign up for that app themselves, approve it, and then grant consent for the entire tenant. Alternatively they can screen share onto the end users session and enter admin credentials when the user is prompted for them.

 

I might be missing something but it seems like there should be a better way to handle this. I only mention the app ID because that's where we can see the login failures in the Azure AD portal, but something along the lines of a "request this application" button displayed to the user that then provided a method for admin approval in the portal would be ideal.

best response confirmed by Jonny Marlborough (Brass Contributor)
Solution

Yup, there's something similar in the works as I hinted above, I cannot share more details until it's publicly announced.

 

You shouldn't need to grant consent to the entire tenant though, you can just assign the app to a group of users. 

Thank you for your replies here, I will keep an eye on what comes out of Ignite. At least now I know that this is just how it works (for now) I can stop trying to work around it.

For anybody else looking for the same answers - there's a admin consent preview available now

 

https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow

 

 @VasilMichev   Can you touch on what was the workaround released in that ignite?

Admin consent workflow is live now. We can block the users consent to apps and enable admin consent workflow to securely approve the app consent requests. 

 

Also, if we have any existing unnecessary applications, we can review those app permissions and remove them completely to eliminate the unwanted security risks.

1 best response

Accepted Solutions
best response confirmed by Jonny Marlborough (Brass Contributor)
Solution

Yup, there's something similar in the works as I hinted above, I cannot share more details until it's publicly announced.

 

You shouldn't need to grant consent to the entire tenant though, you can just assign the app to a group of users. 

View solution in original post