Providing Admin Consent for Office add-ins

Microsoft requires all Office add-ins to adopt Nested App Authentication (NAA), replacing legacy Exchange tokens with Microsoft Entra ID policies for compliance with modern security standards. This ensures secure authentication workflows and adherence to Exchange Online protocols.

Key actions for Admins:

1. Admin Consent Flow (Recommended):
   This prevents individual users from needing to authorize the integration manually, simplifying the migration and reducing user confusion.
   
   • User assignment required setting set to off - if not already. This ensures users can access the application without being part of a specific group. Azure Active Directory > Enterprise applications > Dazychain > Properties.
   • Use this Admin Consent Link to approve permissions for the entire tenant.
   • Note: Only M365 admins can perform this step.
2. Permissions required:
   Ensure the following delegated permissions are granted:
   • Mail.Read
   • Mail.Read.Shared
3. Verify M365 Policies:
   Confirm that no Microsoft 365 (M365) policies are blocking Exchange Online tokens, as this will prevent users from accessing the Outlook integration.

  Note

• NAA is only supported for Exchange Online. Organizations using Exchange 2019 or other on-premises versions will continue using legacy tokens.
• Failure to configure the necessary permissions and policies in M365 could disrupt access to the Outlook integration for all users.

What does this change mean for users?

Opening Dazychain for Outlook add-in for the first time after the update, users will be required to sign into their Microsoft account and Dazychain account. When a session expires, they will be prompted to sign again as they currently do for their Dazychain login.

User enabled consent if Admin Consent Flow is not used

1. Open Outlook application
2. Open Dazychain Outlook add-in
3. Sign in with your email and Dazychain password when prompted
4. Click Log in with your Microsoft account button
5. If a verification dialog appears, click Accept to grant Dazychain the necessary access
6. Enter the Office 365 administrator username and password in the dialog box that appears (if not already).

  Note

If user does not have the correct permission a request will be sent to the admin user. Emails will be unable to be filed until accepted.