OAuth 2.0 and third-party application ID: Timeline extended to June 30, 2022!

Suggestion:  instead of publishing an article giving a brief synopsis of something that will be "effective immediately" and "if you don't do this by 'X' date, logins will fail", include the pertinent information for IT Professionals and Service Owners to act accordingly.

• What firmware versions are required per vendor?
• Are AppIDs per vendor, per phone model, or other?
• What S4B topologies does this impact?
• How does this apply to ExO, specifically regarding Web Services access.
• How are the AppIDs configured and added to the Office365 tenant/Azure AD?
• How does this impact LPE devices or non 3PIP devices?

I cannot emphasize how frustrating it is for customers (and partners) to receive messaging from the PG like this - which causes an immediate knee-jerk reaction - and then have to sift through subsequent communications for pertinent details on implementation.

Measure twice, cut once - you're doing us all (including yourselves) a favor.

Could this be clarified if it's actually for Skype for Business Online only - based on the explanation, assume Skype for Business is actually unaffected (i.e. the on-prem one)?

Please note deadline change in the original post, now January 15, 2020. 

...and a good summary from Tom here:

https://tomtalks.blog/2019/04/all-skype-for-business-ip-phones-must-be-firmware-updated-by-july-1st-2019-to-continue-to-sign-into-office-365/

Audiocodes will have a new firmware available shortly

Tom Arbuthnot has done good post here explaining the change, with links to each vendor as they release the firmware  https://tomtalks.blog/2019/04/all-skype-for-business-ip-phones-must-be-firmware-updated-by-july-1st-2019-to-continue-to-sign-into-office-365/

ThiryDB I'll bring this up with Microsoft again.  They should not be pushing a version older than 5.9.4 as this obviously will cause a problem after they remove the current access method.

Also, remember that Exchange Online is also impacted as this new app is applicable to anything in Office 365.  So, even if an environment is using SfB Server (w/o Hybrid Modern Authentication in place) if Exchange Online is used to store the phone's mailbox then the new app and new firmware versions must be used.  Otherwise the phone will lose calendar/mailbox access in that scenario.

This isn't just about SfB Online; Exchange Online is equally impacted here.

It was just changed last Friday (1/10).

Tristan Griffiths I believe the 'OAuth' portion of this change is what's causing a bunch of confusion.  Technically, it irrelevant.  What is relevant is that Microsoft originally provided access for 3PIP phones to O365 resources and authentication via a built-in Azure enterprise app which all 3PIP-qualified IP phones from all partners have been using.  They want to change that so that the IP phones will only leverage a new, per-vendor app that customers can manage themselves (provide consent on a per-vendor level, and remove the app if desired).  The fact that OAuth 2.0 and Identity Platform 2.0 are involved is really moot, as there is only one course of action: move to the new app model before they disable the old one. 

New firmware versions for impacted devices, once updated, will only use the new app and not the old.  So the process is:

1. Approve the third-party vendor app(s) for the device you have.

2. Update one device to at least minimum supported firmware version, or anything newer.

3. Test.

4. Update all devices so that none remain on older versions which can only use the original app as these will stop working at some point.

Once you get there, then it doesn't matter if/when Microsoft performs this change as you'll no longer be leveraging the old app.

Will it be the same app / consent grant for all phones, or specific per provider? Can you provide the link?

Tom Morgan each phone parntner has to create thier own App ID and the admin has to grant permission for all.

Adam Fowler only if you conifgured oAuth for onprem also.