AWS appstream2: Update OneDrive consent behavior description
Summary
Replaces the 'Require OneDrive for Business admin consent' option with 'Reuse existing Microsoft consent' and clarifies that Azure AD, not WorkSpaces Applications, decides whether admin approval is needed.
Security assessment
The change documents consent/authorization behavior for linking OneDrive accounts, which is security-adjacent (user consent and admin approval), but it is guidance rather than a fix for a specific vulnerability.
Evidence
+ 5. For each domain, choose whether users reuse existing Microsoft consent. **Reuse existing Microsoft consent** is selected by default. When it is selected, users are prompted for consent only if they or an administrator have not already granted it. When it is cleared, users are prompted for consent every time they link their OneDrive for Business account. Your Azure Active Directory environment, not WorkSpaces Applications, decides whether a user needs administrator approval.
Diff
diff --git a/appstream2/latest/developerguide/enable-onedrive.md b/appstream2/latest/developerguide/enable-onedrive.md index 4e449df..074bcb8 100644 --- a//appstream2/latest/developerguide/enable-onedrive.md +++ b//appstream2/latest/developerguide/enable-onedrive.md @@ -41 +41 @@ Follow these steps to enable OneDrive for your WorkSpaces Applications users. - 5. For each domain, you can specify whether users need to get admin consent before linking their OneDrive for Business account to WorkSpaces Applications. **Require OneDrive for Business admin consent** is disabled by default. When you check the box, users are prompted to get the admin consent before linking their OneDrive for Business account. + 5. For each domain, choose whether users reuse existing Microsoft consent. **Reuse existing Microsoft consent** is selected by default. When it is selected, users are prompted for consent only if they or an administrator have not already granted it. When it is cleared, users are prompted for consent every time they link their OneDrive for Business account. Your Azure Active Directory environment, not WorkSpaces Applications, decides whether a user needs administrator approval. @@ -52 +52 @@ Before your users can use OneDrive with WorkSpaces Applications, you must provid -You must configure your Microsoft Azure Active Directory environment to allow end-user consent to applications. For more information, see [Configure how end-users consent to applications](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent) in the Azure Active Directory [Application management](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/) documentation. +Unless an administrator grants consent for the whole tenant and you select **Reuse existing Microsoft consent** for the domain, you must configure your Microsoft Azure Active Directory environment to allow end-user consent to applications. For more information, see [Configure how end-users consent to applications](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent) in the Azure Active Directory [Application management](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/) documentation.