Blog Post

Skype for Business Blog
2 MIN READ

OAuth 2.0 and third-party application ID: Timeline extended to June 30, 2022!

Diana_Vank's avatar
Diana_Vank
Icon for Microsoft rankMicrosoft
Apr 25, 2019

New implementation timeline: June 30, 2022

 

To provide our customers with best-in-class security across our services, Microsoft is implementing the use of Microsoft Identity Platform 2.0 (an evolution of the Azure Active Directory identity service) which uses the OAuth 2.0 authorization protocol. OAuth 2.0 is a method through which a third-party app can access web-hosted resources on behalf of a user, through a third-party application ID.

 

This change only impacts Skype for Business IP Phones certified under 3PIP program.

 

Deployment Type

Impact Statement

Skype for Business Online

All phones must be updated and tenant admins must have approved phone partners App ID using the consent URL

Skype for Business On-Premises Hybrid (With Modern Auth Deployed)

All phones must be updated and tenant admins must have approved phone partners App ID using the consent URL

Skype for Business On-Premises Hybrid (No Modern Auth)

No Impact

Skype for Business On-Premises No Hybrid

No Impact

 

As result of this change, Skype for Business IP Phone partners have made a code change to embed the partner specific application ID in their firmware. The customer tenant admin will be required to confirm consent to allow the third-party phone application to be granted the necessary permissions (the same permissions currently being used by Skype for Business IP Phones).

 

 

Skype for Business IP Phone partners will provide customers with a partner specific consent URL. Customer admin will need to perform a one time, tenant wide (all users), consent per IP Phone partner (i.e. one consent URL for Yealink, one consent URL for Crestron, etc.)

 

Microsoft IP Phone partners will post additional information via their own communication channels, including the firmware version that includes the necessary changes.

 

This change requires customers to perform a 2 step process:

Step 1: Accept permissions request using the consent URL (can be done at any time)

Step 2: Upgrade all impacted phones to the firmware version communicated by the Microsoft IP Phone partners

 

All certified Skype for Business IP phones must be updated by July 15th, 2020 (originally January 15th, 2020). Without the update, successful authentication to Microsoft services on IP Phones will fail. Specifically, signing to the device via web or using a user name/password on the phone will fail. Customers are encouraged to work with their certified Skype for Business IP Phone provider to make the update before the deadline.

Updated Jun 07, 2021
Version 7.0
devices
General
Product Updates
  • Diana_Vank's avatar
    Diana_Vank
    Icon for Microsoft rankMicrosoft
    Apr 14, 2020

    Due to current situation, this change has been postponed until further notice. Original post has been updated with this notification. 

  • Jeff_Schertz's avatar
    Jeff_Schertz
    Iron Contributor
    Apr 09, 2020

    jbishop0511 Most likely the SfB Online Device Updates services will be disabled prior to that event to prevent any incorrect versions being pushed back onto phones which would then break registration on them.

     

    kevinmoran Regardless of whether Microsoft moves the date back or not you shouldn't be running outdated firmware on your phones.  Any firmware releases from 5.9.4 and newer (including 6.x) can only connect to Office 365 using the app model so once they are upgraded and the app is approved in the tenant then it's moot when Microsoft removes the legacy method.

  • kevinmoran's avatar
    kevinmoran
    Copper Contributor
    Apr 09, 2020

    I am curious to know if MS will push back this date given the COVID19 work companies are dealing with.  We are operating under the assumption that the OAuth 2.0 requirement will cause Basic Auth to fail on July 15th for Environments running Skype on-prem, EXO, and Poly handsets for EWS functionality.  

  • jbishop0511's avatar
    jbishop0511
    Copper Contributor
    Apr 02, 2020

    We have already completed the tenant-wide consent.  We have hundreds of Polycom VVX phones on our Skype for Business 100% Online phone system. I am concerned if there are any other actions we need to take .  I assume Microsoft will certify the Poly 5.9.4 version and deploy it to us before the July 15th deadline?? Please advise! 

  • Larry Thomas's avatar
    Larry Thomas
    Copper Contributor
    Jan 14, 2020

    Ok thanks Jeff

     

    I guess my earlier information that I received from MS Support was indeed correct

  • Jeff_Schertz's avatar
    Jeff_Schertz
    Iron Contributor
    Jan 14, 2020

    Larry Thomas 

    I'm not sure what you're asking to confirm as that summary is essentially what this entire article is about.  What needs to be done I explained just two responses up from yours.

     

    In short: On that date all affected phones will no longer be able to connect to Skype for Business Online or Exchange Online, regardless of the manufacturer, model, firmware version, or authentication method.  Additionally Skype for Business Server deployments which have Hybrid Modern Authentication enabled will also be impacted.

    To prevent any connection issues (1) the new app must be approved in the O365 tenant and (2) each device upgraded to the minimum supported firmware version.

  • ga_p's avatar
    ga_p
    Brass Contributor
    Jan 14, 2020

    Larry Thomas 

     

    That's true only for users hosted on MS cloud. Users hosted on-prem will loose access to their calendar\voicemail from the phone, but they will be able to sign-in.