Change Azure Config

PS: In your documentation, you're still referencing to "Azure Active Directory Graph!

...

support.sophos.com/.../KB-000042194

Hi,

 some comments from me:

• Azure Active Directory Graph is depreciated by Microsoft since June 2022. It was a typo in the first article.
• The first initialization of ZTNA/AD Sync was done with a Sophos certified consultant. Also, the Graph permissions are done with him.
• Once again: It worked in the beginning. The problem occurred when trying changing "Add users by group ID" in the "Azure Config"!
• We've another Central/tenant running with the same type of Azure App config an ZTNA.It works. We still didn't try to change the config because we want to avoid taking the risk of ruin a working system.
• It looks to me, that the query of the connection test is faulty 

I'm surprised not getting any response.

Regards

Henry

See: https://docs.sophos.com/central/ZTNA/startup/en-us/troubleshooting/index.html#access-issues

Check that you've enabled all the required API Permissions for your identity provider.

For Azure, you need these Microsoft Graph API permissions:

• Directory.Read.All (Delegated)
• Directory.Read.All (Application)
• Group.Read.All (Delegated)
• openID (Delegated)
• profile (Delegated)
• User.Read (Delegated)
• User.Read.All (Delegated)

Currently you also need an Azure AD API permission: Directory.ReadWrite.All (Application). See Register the ZTNA app.

Die old API is still supported until June 2023. https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview

Hi,

• I can't add AD Graph. I assume, it's only available when used before June 2022.
• All other permissions are there.

You can add it via the point "Own applications":

Thx,

now it works .

I'm asking myself why it worked when initially creating the sync (all tests passed).

regards

Henry

Got an Info from the support:

There was an issue that has been fixed. You should be able to remove the deprecated APIs now and the sync should be possible between Azure and Sophos Central. Only Microsoft graph API permissions are needed.

Regards

Henry