search

microsoft / coe-starter-kit

Other
754 stars 225 forks source link

[CoE Starter Kit - QUESTION] QUESTION - Security update to “Http With Microsoft Entra ID (preauthorized)” connector [MC901932] #9063

Open SPMush opened 1 month ago

SPMush commented 1 month ago

Does this question already exist in our backlog?

What is your question?

Hi , After checking my tenant for apps and flows using the http With Microsoft Entra ID (preauthorized) connector the CoE Admin view app lists the following Apps as using the connector. App display name:

Flow display names:

Although the Service announcement states "Existing connections will continue to work." Are there any specific actions CoE Admins will need to perform and will the CoE deployment guide require updating for new deployments of the Kit?

What solution are you experiencing the issue with?

None

What solution version are you using?

Sept 2024

What app or flow are you having the issue with?

No response

What method are you using to get inventory and telemetry?

Cloud flows

Jenefer-Monroe commented 1 month ago

oh boy, thanks for sharing I hadnt seen this. I will need to investigate.

Grant-Archibald-MS commented 1 month ago

Thanks @SPMush we are following up for impacts and what mitigations will be required to work with this security update. As we find further information and guidance we will comment here.

We will also look to give an update on what information we have during our next community Office hours on Wednesday Oct 9th.

ToshiakiKa commented 3 weeks ago

Hi @Grant-Archibald-MS, Can you please kindly share updates made at community Office hours on Wednesday Oct 9th? As @SPMush mentioned Although the Service announcement MC901932 states "Existing connections will continue to work." Are there any specific actions CoE Admins will need to perform for exsiting (already installed) CoE kit?

Jenefer-Monroe commented 3 weeks ago

We've been told that the change here to make these fail for new connections has been delayed until the PowerShell is incorporated into the official PP Power Shell scripts, although I do not see that reflected in the notice as of today.

At this time the POR is to keep the pre-auth connectors in place and require that admins approve the sopes for the users that run the flows. Then we will add to the setup wizard a way to check and validate that you have the appropriate scopes approved.

Here are the scopes that you will need. Image

You can do the work now if you would like using the unsigned PowerShell script. See Authorize the connector to act on behalf of a signed-in user

ToshiakiKa commented 3 weeks ago

Thanks @Jenefer-Monroe for updating. Is it okay for Admins of exisiting CoE kit to wait for official PP Power Shell scripts release / additional anouncement from Microsoft? It is apprecaited if you clarify if there is any specific action Admin have to do at this moment to avoid discurption of CoE kit behaviros.

Jenefer-Monroe commented 3 weeks ago

That is my understanding, that you can wait until the scripts are signed and official. However I'm nervous too as the date is not yet fixed to reflect this. I will ask @Grant-Archibald-MS who owns the communication with the owning product team to please validate this.

ToshiakiKa commented 3 weeks ago

Thanks @Jenefer-Monroe. Please share update on this thread or anywhere github of CoE when anything Admins should do is decided at CoE kit side.

Jenefer-Monroe commented 3 weeks ago

Added to Nov release ability to see if you have the correct graph permissions in the setup wizard via https://github.com/microsoft/coe-starter-kit/issues/9118

Image

Jenefer-Monroe commented 3 weeks ago

Moving this issue to be the one for Grant to use while iterating on the product feature itself.

We've reached out to them for current status given we've been told this is delayed, as well as given them some feedback on the ps script so that it can continue to improve as this feature moves forward.

Jenefer-Monroe commented 3 weeks ago

Have received confirmation that this deprecation has been delayed.

So new connections to the pre-auth connector will continue to work past tomorrow, the currently shown deadline in message center. They will be updating message center with a new date after they derive it.