67% helpful (2/3)

Admin consent required before the next upgrade (Update 16) is applied

 

Admin consent required before the next upgrade (Update 16) can be applied

Microsoft is deprecating Azure AD Graph API in June 2022, and as of June 30th, 2020, stopped adding new features to the API. See these Microsoft articles for more information:

Microsoft strongly recommends upgrading to Microsoft Graph API to access Azure AD APIs or APIs from other Microsoft services. Nintex K2 Cloud OAuth resources requiring access to the https://graph.windows.net API (Azure AD Graph), must be updated to use https://graph.microsoft.com (Microsoft Graph) as part of the migration from Azure AD Graph to Microsoft Graph. Nintex K2 Cloud Update 16 includes the code fixes necessary for this migration.
After the upgrade of your Nintex K2 Cloud environment to Update 16, the OAuth resources that require access to AAD Graph API will be updated to use Microsoft Graph API instead.

This will affect Package and Deployment tool and the workflows using the Azure Active Directory broker. These workflows can enter a failed state if the workflow executes a step that uses the broker after upgrade, but before a Global administrator in your organization re-consents to the Microsoft Graph permissions. These workflows will have to be manually repaired after upgrade and re-consent.

We recommend that a Global administrator consent to the Microsoft Graph permissions before the upgrade to Update 16 to avoid the extra work of repairing the workflows that use the Azure Active Directory broker.

This will also let your users continue to package and deploy your solutions.

Consent to the Microsoft Graph permissions

Follow these steps before the upgrade to Update 16, to grant Admin consent to the Microsoft Graph permissions.

  1. In K2 Management, browse to Integration > Service Types and select the Azure Active Directory service type. Click New Instance.
    SrvsType-ian.png
  2. Configure the Service Instance as described in the Service Instances topic of the Nintex K2 Cloud user guide but make sure to enter https://graph.microsoft.com as the OAuth Resource Audience. You must also tick the checkbox “Cache OAuth token for service account for using SmartObjects in workflow steps
    2021-10-26 12_22_23-Admin consent is required before the next upgrade.docx  -  Read-Only - Word.png
You will only see the full authorization flow if your Nintex K2 Cloud environment doesn’t have the graph.microsoft.com token.
If you have previously consented to the new permissions and then run through this re-consent flow, you will not see the OAuth error, or permissions page described below in steps 3 and 4.
  1. When you click OK on the Configure Service Instance form, the OAuth Error dialog shows. Click OK again to be redirected for authorization.
    OAuthError.png
  2. Sign in with your Global administrator credentials and Accept the permissions request to continue. Since permissions required for Azure AD Graph API differ from those for Microsoft Graph API, you will be consenting to similar permissions scopes for backward and future compatibility. For more information, see the topic Applications for integrating with third-party technologies in the Nintex K2 Cloud help documentation.
    consent-ian.png
  3. You are redirected to the Authorization Successful page, at which point the new Microsoft Graph resource token is created (if it didn't exist). Close the tab to return to the K2 Management site.
  4. You are returned to the Service Instance registration page after the token is created. Click Cancel as there is no need to create a new Service Instance after completing the consent flow.
    ConfSvrInst2.png
  5. Repeat the above steps (1-6) for the AADMGMT resource if used. Make sure to select AADMGMT as the OAuth Resource. 2021-10-26 12_23_30-Admin consent is required before the next upgrade.docx  -  Read-Only - Word.png

Post Upgrade Steps

Follow these steps after the upgrade to Update 16, in order to switch existing service instances to use https://graph.microsoft.com (Microsoft Graph API).

 

1. In K2 Management, browse to Integration > Service Instances and select the service instance using Azure Active Directory service type. Click Edit.

2021-11-03 12_35_38-Follow these steps after the upgrade to Update 16.docx - Word.png

2. Update the OAuth Resource Audience to use https://graph.microsoft.com and click OK.

2021-11-03 12_36_56-Follow these steps after the upgrade to Update 16.docx - Word.png

 

Labels: (1)
Version history
Last update:
3 weeks ago
Updated by:
Contributors