AWS appstream2: Clarify OneDrive/Azure AD admin consent behavior
Summary
Rewrites guidance on Microsoft Azure AD consent for OneDrive integration, explaining tenant-wide admin consent and the 'Reuse existing Microsoft consent' option versus per-user consent prompts.
Security assessment
Documents how OAuth/application consent is granted in Azure AD for the OneDrive integration, clarifying admin-consent vs end-user-consent flows; this is security-adjacent authorization guidance rather than a fix for a specific vulnerability.
Evidence
Your Azure Active Directory environment, not WorkSpaces Applications, decides whether users can consent on their own or need administrator approval.
Diff
diff --git a/appstream2/latest/developerguide/onedrive.md b/appstream2/latest/developerguide/onedrive.md index 86a6787..af463d7 100644 --- a//appstream2/latest/developerguide/onedrive.md +++ b//appstream2/latest/developerguide/onedrive.md @@ -24 +24 @@ You can enable one or more options for your organization. When you enable OneDri -You can enable OneDrive for Business for accounts in your OneDrive domains only, but not for personal accounts. WorkSpaces Applications requires that you configure your Microsoft Azure Active Directory environment to allow end-user consent to applications. For more information, see [Configure how end-users consent to applications](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent) in the Azure Active Directory [Application management](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/) documentation. +You can enable OneDrive for Business for accounts in your OneDrive domains only, but not for personal accounts. Unless an administrator grants consent for the whole tenant and you select **Reuse existing Microsoft consent** for the domain, you must configure your Microsoft Azure Active Directory environment to allow end-user consent to applications. For more information, see [Configure how end-users consent to applications](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent) in the Azure Active Directory [Application management](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/) documentation. @@ -26 +26 @@ You can enable OneDrive for Business for accounts in your OneDrive domains only, -The admin consent workflow lets administrators grant access to applications that require administrator approval. If the admin consent workflow is configured in your Azure Active Directory environment, follow the step given in [Enable OneDrive for Your WorkSpaces Applications Users](./enable-onedrive.html) to specify the domains that require admin consent. +Your Azure Active Directory environment, not WorkSpaces Applications, decides whether users can consent on their own or need administrator approval. If your environment requires administrator consent, an administrator must grant consent to WorkSpaces Applications for the whole tenant. Then select **Reuse existing Microsoft consent** for each domain, as described in [Enable OneDrive for Your WorkSpaces Applications Users](./enable-onedrive.html). If that option is cleared, users are prompted for consent every time they link their account, and users who can't consent on their own are blocked even after an administrator grants consent.