June 28th Update: Accept the one-time permissions request when logging in via Microsoft SSO

Lekshmi Unnithan

Update as of June 28, 2023:

Smartsheet has migrated away from the deprecated Azure Active Directory (AD) Graph service to the new Microsoft Graph service effective today, June 27, 2023.

Please accept the one-time permissions request when using Microsoft SSO to ensure a successful login and continued access to Smartsheet. If you are an Azure Administrator, please check the additional checkbox option to consent to the permissions on behalf of your entire organization or grant admin consent for Smartsheet directly from Azure.

For more context, please read the advanced notice communications below.

先进的注意沟通:

Hi Community,

On June 28, 2023, Smartsheet will be migrating away from the deprecated Azure Active Directory (AD) Graph service to the new Microsoft Graph service.

What this means for you:If you are attempting to log into Smartsheet using Microsoft Single Sign-On (SSO) on or after June 28, 2023, you will see a one-time permissions request, which you must accept to successfully log in and access your underlying Smartsheet instance. Failure to accept these permissions will result in an unsuccessful login attempt via Microsoft SSO.

If you are an Azure Administrator:

1. You will also be provided with an additional checkbox option to consent to the permissions on behalf of your entire organization. We strongly encourage you to check this box when accepting the new permissions so that others in your organization can continue to access Smartsheet without interruption via Microsoft SSO.
2. Azure管理员也可以授予管理对Smar同意tsheet for different enterprise applications directly from Azure. To do so, follow this navigation path: Azure Home > Enterprise Apps > Search for "Smartsheet" > click on "Grant admin consent for Smartsheet"

Please note:

1. You have previously consented to the same permissions for utilizing Microsoft SSO to log into Smartsheet via the Azure Graph service. We simply need to resurface the consent form because we’re migrating to the new Microsoft Graph service.
2. You may also be prompted with the permissions request form if you attempt to authenticate into Smartsheet using Microsoft SSO from other third-party apps/integrations. If you encounter this situation, please accept the request to ensure uninterrupted access to your Smartsheet assets.

This change impacts all users utilizing login via Microsoft SSO in Free, Pro, Business, Enterprise, Premier, and legacy plans (Individual, Basic, Advanced - Legacy, Team, and Enterprise - Legacy), including free collaborators, unlicensed users, and Trial users.

To see the Microsoft announcement regarding the deprecation of the Azure AD Graph service,click here. We will update this community post when we officially migrate to the Microsoft Graph service. You can also stay informed by subscribing to receive product release updates for curated news of recently released product capabilities and enhancements for the platform of your choosing, delivered to your inbox. As new releases occur, you will receive a weekly email with news of what's released every Tuesday.

Best regards,

The Smartsheet Product Team

Product screenshots

1. Permissions request form for Azure administrators:

2. Azure consent flow for Azure admins:

InnoceanKP

Hi, will this email for permission be coming from our internal IT team or will it be coming from Microsoft or Smartsheet?

whynotpizza

Which "Smartsheet" Enterprise application, can you provide the Application ID? Thank you.

Jen M.

Will this also occur for those using same sign-on (logging in using the Microsoft login button that recognizes O365 credentials)? Or just Single Sign On/SSO?

aamanley

@InnoceanKPthe article makes it sound like it will be a prompt that pops up for all users (so Smartsheet) but that the Azure Administrator could accept this on behalf of users and nothing else would pop up. I could've misinterpreted the article though.

Good questions all around though, hopefully we'll hear something back on this channel soon.

scot tupper

I received the email last night from[email protected]and I am not a sys admin. In reading this, it sounds like it will only impact users of the desktop app but I have a call into our rep to clarify.

Pam Ferguson

Only some of our users received this email, not all. Why? Just need to understand if this affects everyone or not. Kind of late if it affects everyone.

Lekshmi Unnithan

Hi, will this email for permission be coming from our internal IT team or will it be coming from Microsoft or Smartsheet?<\/p>","bodyRaw":"[{\"insert\":\"Hi, will this email for permission be coming from our internal IT team or will it be coming from Microsoft or Smartsheet?\\n\"}]","format":"rich","dateInserted":"2023-06-23T12:16:41+00:00","insertUser":{"userID":162300,"name":"InnoceanKP","title":"Senior Digital Asset Manager","url":"https:\/\/community.smartsheet.com\/profile\/InnoceanKP","photoUrl":"https:\/\/us.v-cdn.net\/6031209\/uploads\/defaultavatar\/nWRMFRX6I99I6.jpg","dateLastActive":"2023-06-27T15:13:55+00:00","banned":0,"punished":0,"private":false,"label":"✭"},"displayOptions":{"showUserLabel":false,"showCompactUserInfo":true,"showDiscussionLink":false,"showPostLink":false,"showCategoryLink":false,"renderFullContent":false,"expandByDefault":false},"url":"https:\/\/community.smartsheet.com\/discussion\/comment\/381917#Comment_381917","embedType":"quote"}"> https://community.smartsheet.com/discussion/comment/381917#Comment_381917

Hi@InnoceanKP- when a user attempts to log into Smartsheet using Microsoft SSO, then Microsoft will be the one to prompt the permissions request form on the screen (it will not be an email). Once the permissions are accepted, then the user can access Smartsheet. Let me know if you have any further questions.

Lekshmi Unnithan

Which "Smartsheet" Enterprise application, can you provide the Application ID? Thank you.<\/p>","bodyRaw":"[{\"insert\":\"Which \\\"Smartsheet\\\" Enterprise application, can you provide the Application ID? Thank you.\\n\"}]","format":"rich","dateInserted":"2023-06-23T12:26:00+00:00","insertUser":{"userID":162678,"name":"whynotpizza","url":"https:\/\/community.smartsheet.com\/profile\/whynotpizza","photoUrl":"https:\/\/us.v-cdn.net\/6031209\/uploads\/defaultavatar\/nWRMFRX6I99I6.jpg","dateLastActive":"2023-06-23T17:32:31+00:00","banned":0,"punished":0,"private":false,"label":"✭"},"displayOptions":{"showUserLabel":false,"showCompactUserInfo":true,"showDiscussionLink":false,"showPostLink":false,"showCategoryLink":false,"renderFullContent":false,"expandByDefault":false},"url":"https:\/\/community.smartsheet.com\/discussion\/comment\/381919#Comment_381919","embedType":"quote"}"> https://community.smartsheet.com/discussion/comment/381919#Comment_381919

Hi@whynotpizza- to get the list of application IDs, please submit a support ticket and a team member will get back to you.

Lekshmi Unnithan

Will this also occur for those using same sign-on (logging in using the Microsoft login button that recognizes O365 credentials)? Or just Single Sign On\/SSO?<\/p>","bodyRaw":"[{\"insert\":\"Will this also occur for those using same sign-on (logging in using the Microsoft login button that recognizes O365 credentials)? Or just Single Sign On\\\/SSO?\\n\"}]","format":"rich","dateInserted":"2023-06-23T14:28:53+00:00","insertUser":{"userID":162689,"name":"Jen M.","title":"Strategist","url":"https:\/\/community.smartsheet.com\/profile\/Jen%20M.","photoUrl":"https:\/\/us.v-cdn.net\/6031209\/uploads\/defaultavatar\/nWRMFRX6I99I6.jpg","dateLastActive":"2023-07-04T14:04:30+00:00","banned":0,"punished":0,"private":false,"label":"✭"},"displayOptions":{"showUserLabel":false,"showCompactUserInfo":true,"showDiscussionLink":false,"showPostLink":false,"showCategoryLink":false,"renderFullContent":false,"expandByDefault":false},"url":"https:\/\/community.smartsheet.com\/discussion\/comment\/381979#Comment_381979","embedType":"quote"}"> https://community.smartsheet.com/discussion/comment/381979#Comment_381979

Hi@Jen M.- Can you please elaborate on your question? What do you mean by the login button that recognizes the O365 credentials?

Lekshmi Unnithan

@InnoceanKP<\/a> the article makes it sound like it will be a prompt that pops up for all users (so Smartsheet) but that the Azure Administrator could accept this on behalf of users and nothing else would pop up. I could've misinterpreted the article though.<\/p>

Good questions all around though, hopefully we'll hear something back on this channel soon.<\/p>","bodyRaw":"[{\"insert\":{\"mention\":{\"name\":\"InnoceanKP\",\"userID\":162300}}},{\"insert\":\" the article makes it sound like it will be a prompt that pops up for all users (so Smartsheet) but that the Azure Administrator could accept this on behalf of users and nothing else would pop up. I could've misinterpreted the article though.\\nGood questions all around though, hopefully we'll hear something back on this channel soon.\\n\"}]","format":"rich","dateInserted":"2023-06-23T14:32:36+00:00","insertUser":{"userID":157552,"name":"aamanley","url":"https:\/\/community.smartsheet.com\/profile\/aamanley","photoUrl":"https:\/\/aws.smartsheet.com\/storageProxy\/image\/images\/u!!xCHdcRr76Hw!XBDQ34yuB3Y!dYrrZLF1c6b","dateLastActive":"2023-06-29T16:03:10+00:00","banned":0,"punished":0,"private":false,"label":"✭✭"},"displayOptions":{"showUserLabel":false,"showCompactUserInfo":true,"showDiscussionLink":false,"showPostLink":false,"showCategoryLink":false,"renderFullContent":false,"expandByDefault":false},"url":"https:\/\/community.smartsheet.com\/discussion\/comment\/381980#Comment_381980","embedType":"quote"}"> https://community.smartsheet.com/discussion/comment/381980#Comment_381980

Hi@aamanley- The permissions request prompt will be displayed when logging into Smartsheet, but it will be Microsoft pushing the prompt. Let me know if you have any questions.

Lekshmi Unnithan

I received the email last night from productinfo@smartsheet.com and I am not a sys admin. In reading this, it sounds like it will only impact users of the desktop app but I have a call into our rep to clarify.<\/p>","bodyRaw":"[{\"insert\":\"I received the email last night from productinfo@smartsheet.com and I am not a sys admin. In reading this, it sounds like it will only impact users of the desktop app but I have a call into our rep to clarify.\\n\"}]","format":"rich","dateInserted":"2023-06-23T15:12:37+00:00","insertUser":{"userID":157976,"name":"scot tupper","url":"https:\/\/community.smartsheet.com\/profile\/scot%20tupper","photoUrl":"https:\/\/aws.smartsheet.com\/storageProxy\/image\/images\/u!1!BEDmARvGKWs!HZlnn1Ozkzs!BAzk9Ud4lRH","dateLastActive":"2023-06-30T16:09:44+00:00","banned":0,"punished":0,"private":false,"label":"✭✭"},"displayOptions":{"showUserLabel":false,"showCompactUserInfo":true,"showDiscussionLink":false,"showPostLink":false,"showCategoryLink":false,"renderFullContent":false,"expandByDefault":false},"url":"https:\/\/community.smartsheet.com\/discussion\/comment\/381997#Comment_381997","embedType":"quote"}"> https://community.smartsheet.com/discussion/comment/381997#Comment_381997

Hi@scot tupper- Individual users will also be prompted with the permissions request form if they attempt to log into Smartsheet with Microsoft SSO after we complete the migration. However, if an Azure Admin consents on behalf of the entire org beforehand, then individual users will not receive the prompt. Please note that Azure Admins can even consent for the org before or after the migration occurs on June 28th.

Do let me know if you have any further questions.

Lekshmi Unnithan

Only some of our users received this email, not all. Why? Just need to understand if this affects everyone or not. Kind of late if it affects everyone.<\/p>","bodyRaw":"[{\"insert\":\"Only some of our users received this email, not all. Why? Just need to understand if this affects everyone or not. Kind of late if it affects everyone. \\n\"}]","format":"rich","dateInserted":"2023-06-23T15:22:05+00:00","insertUser":{"userID":107206,"name":"Pam Ferguson","title":"","url":"https:\/\/community.smartsheet.com\/profile\/Pam%20Ferguson","photoUrl":"https:\/\/aws.smartsheet.com\/storageProxy\/image\/images\/u!!wc1AMAYHDEQ!woNBt-bwO3Q!6Y9I4ypKEQB","dateLastActive":"2023-06-29T20:29:04+00:00","banned":0,"punished":0,"private":false,"label":"Overachievers"},"displayOptions":{"showUserLabel":false,"showCompactUserInfo":true,"showDiscussionLink":false,"showPostLink":false,"showCategoryLink":false,"renderFullContent":false,"expandByDefault":false},"url":"https:\/\/community.smartsheet.com\/discussion\/comment\/382000#Comment_382000","embedType":"quote"}"> https://community.smartsheet.com/discussion/comment/382000#Comment_382000

@Pam Ferguson- The advanced notice email went out to all users who have logged into Smartsheet at least once in the last 60 days and used Microsoft SSO for authentication. This will impact any user who attempts to log into Smartsheet using Microsoft SSO after we complete the migration on June 28th (as mentioned in the post above) and they will receive a permissions request prompt from Microsoft. After accepting the prompt, they can successfully log into Smartsheet. Please let me know if you have any further questions. Additionally, Azure Admins can even consent for the org before or after the migration occurs on June 28th.

TE_MN

I am an Azure Admin and just went in to grant admin consent for the Enterprise application. It is now showing but the permission details show the Resource Application as Azure Active Directory. Is that correct? Should there be an indication that access is granted for Microsoft Graph?

cebert

My Azure Admins & InfoSec Teams are saying that the amount of permissions Smartsheet is requesting with this new change are higher than previously and wondering if those can be changed to Sign In and Read Profile.

Who can my team talk with at Smartsheet about this?

Lekshmi Unnithan

My Azure Admins & InfoSec Teams are saying that the amount of permissions Smartsheet is requesting with this new change are higher than previously and wondering if those can be changed to Sign In and Read Profile.<\/p>

Who can my team talk with at Smartsheet about this?<\/p>","bodyRaw":"[{\"insert\":\"My Azure Admins & InfoSec Teams are saying that the amount of permissions Smartsheet is requesting with this new change are higher than previously and wondering if those can be changed to Sign In and Read Profile.\\nWho can my team talk with at Smartsheet about this?\\n\\n\"}]","format":"rich","dateInserted":"2023-06-23T20:51:43+00:00","insertUser":{"userID":140988,"name":"cebert","url":"https:\/\/community.smartsheet.com\/profile\/cebert","photoUrl":"https:\/\/aws.smartsheet.com\/storageProxy\/image\/images\/u!1!g29cp1RTPXo!g2tdXxAYvLw!kOiDHTGKDgn","dateLastActive":"2023-06-23T22:58:30+00:00","banned":0,"punished":0,"private":false,"label":"✭✭"},"displayOptions":{"showUserLabel":false,"showCompactUserInfo":true,"showDiscussionLink":false,"showPostLink":false,"showCategoryLink":false,"renderFullContent":false,"expandByDefault":false},"url":"https:\/\/community.smartsheet.com\/discussion\/comment\/382113#Comment_382113","embedType":"quote"}"> https://community.smartsheet.com/discussion/comment/382113#Comment_382113

@cebert- For anynew users(i.e., anyone who has not previously authenticated into Smartsheet using Microsoft SSO), thepermissions requested will be all the ones shown in the screenshot below. (We've included the permissions consent form and the corresponding permissions with their descriptions).

However, forreturning users(i.e., anyone who has already authenticated into Smartsheet via Microsoft SSO before but is attempting to log in after we do the migration), theonly permission requested isUser.Readfrom Microsoft Graph API, which is replacing the currentUser.Readfrom Azure AD Graph API.User.Readis for signing in and reading the user profile.

Please let me know if you have any further questions.