Changes in external applications and add-ins with Office 365

Hi, everyone, hope you had a good Thanksgiving!
I wanted to let you know about a change that was put in place on Argonne’s Office 365 service a couple of weeks back. The high level summary is that if you try to authorize a new application to access your mail, you may encounter a new step and a delay in before it can be used.
Earlier this year, it was discovered some bad actors were using poorly (and in some cases maliciously) built add-ins and apps to leverage that access and steal data. While the known bad apps were blacklisted as soon as this was discovered (and there was no known usage at Argonne), it started the conversation of how we can better protect ourselves and prevent this in the future.
Ultimately, it ended with any application or Office 365 add-in that requests access to your data (beyond simply checking mail) will not be automatically approved. Prior to this change, if you added an app that requested this access, you alone would authorize or deny that access via a permissions request pop-up. Now there’s an additional step for any application that is not already authorized. Specifically, you will be asked to explain why the application is needed, which will kick off a review where ANL Cyber can confirm the application is safe and allowed to access our data.
There’s a Vector Knowledge Base article that explains the process here if you want more detail: servicenow.anl.gov/self_service/knowledge_detail.do?sysparm_document_key=kb_knowledge,ccb3b40e1b3428500205ed3ce54bcb47 (yeah, real pretty URL, sorry about that).
A number of applications have been pre-approved, so you may never encounter this. Some others are in review or not yet authorized. If you try to add these applications to a new computer, or if your monthly Multi Factor Authentication (MFA) cycle comes up for an app you’re already using that hasn’t been approved, you will see the permissions explanation and be given the opportunity to request access.
If the app is found to be safe, you will receive a notification via email after it’s been approved.
Ultimately, the goal here is to make sure Argonne’s and your data is secure, and that you have awareness of what’s accessing it. Please let me know if you encounter any issues.
Thanks!