Microsoft Entra ID (formerly Azure Active Directory) (App Registration) Migration to Microsoft Graph

Introduction

This article explains the transition from using the "Windows Azure Active Directory" API to the "Microsoft Graph" API within an already registered application. 

The shift is essential because the "Windows Azure Active Directory" has been deprecated. Microsoft has announced that the "Azure Active Directory (Azure AD) Graph" will be retired anytime post-June 30, 2023, without any prior notice. 

Therefore, users are advised to migrate to the Microsoft Graph API to avoid any disruptions.

Steps

Please follow the “Configuring the permissions” section in Azure Active Directory (App Registration) - Azure AD.

After adding the permissions you should have the following permissions defined:

Removal of Windows Azure Active Directory API permissions

1. In the “API permissions” screen, click on the three-dotted menu next to “Azure Active Directory Graph”.

2. Select the “Remove all permissions” option.

3. Confirm the removal and you should have only the following permissions left:

4. Verify you are able to connect to your Harmony SASE account using your Microsoft Entra ID credentials.

Recommendations

• To grant the necessary permissions for the Microsoft Graph API, follow the instructions in the “Configuring the permissions” section found in the Azure Active Directory (App Registration) - Azure AD guide.
• To remove the "Windows Azure Active Directory API" permissions, navigate to the “API permissions” screen. Click on the three-dotted menu next to “Azure Active Directory Graph” and choose the “Remove all permissions” option.

Troubleshooting

If you encounter issues during or after the setup, try reviewing your settings to ensure everything matches the instructions. In particular, check the IP addresses and other details you entered during setup. If issues persist, please consult our dedicated support.

Support Contacts

If you have any difficulties or questions, don't hesitate to contact Harmony SASE's support team. We offer 24/7 chat support on our website at Perimeter81.com, or you can email us at sase-support@checkpoint.com. We're here to assist you and ensure your VPN tunnel setup is a success