Service | Microsoft Docs article | Related commit history on GitHub | Change details |
---|---|---|---|
platform | Grant Resource Specific Consent | https://github.com/MicrosoftDocs/msteams-docs/commits/main/msteams-platform/graph-api/rsc/grant-resource-specific-consent.md | The tenant-level controls of application RSC permissions vary based on the resou For delegated permissions, any authorized user can consent to the permissions requested by the app. +>[!WARNING] +> From March 2024, the way you manage settings for team and chat RSC permissions will change. The following instructions include the dates when new settings will be available for admins to modify. These settings will not change for government clouds and we will communicate when the settings change for government clouds. ++<b> Before March 14th, 2024 </b> <br> <details> -<summary><b>Configure group owner consent settings for RSC in a team using the Microsoft Entra admin center</b></summary> +<summary><b>Configure group owner consent settings for RSC in a team using the Microsoft Entra admin center [Will be deprecated in March 2024]</b></summary> ++>[!IMPORTANT] +>After March 14th, 2024, this setting will be deprecated and no longer available for adjustments. After it is deprecated, use the PowerShell cmdlets listed in **Configure team RSC via PowerShell cmdlets** to adjust your team RSC settings. You can enable or disable group owner consent directly within the Microsoft Entra admin center: In addition, you can enable or disable group owner consent using PowerShell. Fol <br> <details> -<summary><b>Configure chat owner consent settings for RSC in a chat using the Graph APIs</b></summary> +<summary><b>Configure chat owner consent settings for RSC in a chat using Graph APIs [Will be deprecated in May 2024]</b></summary> ++>[!IMPORTANT] +>After March 14, you must use the PowerShell cmdlets listed in **Configure chat RSC via PowerShell cmdlets** to manage your chat RSC settings. You can enable or disable RSC for chats using Graph API. The property `isChatResourceSpecificConsentEnabled` in [teamsAppSettings](/graph/api/teamsappsettings-update#example-1-enable-installation-of-apps-that-require-resource-specific-consent-in-chats-meetings) governs whether chat RSC is enabled in the tenant. The default value of the property `isUserPersonalScopeResourceSpecificConsentEna <br> +>[!IMPORTANT] +>The pre-selection period for the transition from Group Owner Consent to PowerShell-based team RSC has started and remains active until March 4, 2024. After that, the transition to team RSC policies is managed by PowerShell. +<br> ++<b> After March 14th, 2024 </b> ++Admins adjust team and chat RSC settings through PowerShell cmdlets. The following are the available states for the PowerShell settings and each section shows examples of how to use these states to adjust your settings: ++| PowerShell State | Description | +| - | - | +| ManagedByMicrosoft | This is the default state for all tenants. It allows chat and team RSC permissions to be consented for all users but can be changed at any time at Microsoft's discretion. | +| EnabledForAllApps | Any app requesting RSC permissions can be consented to by users (resource owners) in your tenant. | +| DisabledForAllApps | No RSC permissions can be consented to by users. | ++<br> +<details> ++<summary><b>Configure team RSC through PowerShell cmdlets</b></summary> +<br> ++You can configure which users are allowed to consent to apps accessing their teams' data by using the available PowerShell states, such as ManagedByMicrosoft, EnabledForAllApps, and DisabledForAllApps. +<br> ++The following example shows how to enable team RSC for all apps: +<br> ++```powershell +Set-MgBetaTeamRscConfiguration -State EnabledForAllApps +``` ++</details> +<br> +<details> ++<summary><b>Configure chat RSC through PowerShell cmdlets</b></summary> +<br> ++You can configure which users are allowed to consent to apps accessing their chats' data by using the available PowerShell states, such as ManagedByMicrosoft, EnabledForAllApps, and DisabledForAllApps. +<br> ++The following example shows how to enable chat RSC for all apps: +<br> ++```powershell +Set-MgBetaChatRscConfiguration -State EnabledForAllApps +``` ++</details> +<br> +<details> ++<summary><b>Configure user owner consent settings for RSC for a user using the Graph APIs</b></summary> ++You can enable or disable RSC for user using Graph API. The `isUserPersonalScopeResourceSpecificConsentEnabled` property in [teamsAppSettings](/graph/api/teamsappsettings-update#example-1-enable-installation-of-apps-that-require-resource-specific-consent-in-chats-meetings) governs whether user RSC is enabled in the tenant. +++The default value of the `isUserPersonalScopeResourceSpecificConsentEnabled` property is based on whether [user consent settings](/azure/active-directory/manage-apps/configure-user-consent?tabs=azure-portal) is turned on or off in the tenant when RSC for user is first used. The default value is defined either when: ++* [TeamsAppSettings](/graph/api/teamsappsettings-get) are retrieved for the first time. +* Teams app with RSC permissions is installed for a user. ++> [!NOTE] +> Admin control is added to allow or block RSC consent settings based on the sensitivity of the data accessed. It isn't based on the single master switch that enables or disables consent settings for app RSC permissions for all apps in the tenant. ++</details> ++<br> + ### Upload your custom app in Teams If your Teams admin allows custom app uploads, you can [upload your custom app](~/concepts/deploy-and-publish/apps-upload.md) directly to a specific team, chat, or user. |