Microsoft Graph: "Need admin approval" for non admin consent required scope "User.ReadBasic.All" during login

user_602449 0
Viewed 5458

I have the following setup:

AAD Directory A with an app registration. The app registration is marked as a Multi-Tenant app and has no permissions requested per default:

enter image description here

During login my webapp redirects to the Microsoft Login like this (nonce and redirect uri is removed):

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?
client_id=05f0df69-2f61-4b41-91ff-31656787f9d3
&redirect_uri=https%3A%2F%2F....azurewebsites.net%2Fids%2Foidc-signin-office365auth
&response_type=code%20id_token&scope=openid%20profile%20email%20User.Read%20offline_access%20User.ReadBasic.All
&response_mode=form_post
&nonce=...

The scopes are:

  • openid
  • profile
  • email
  • User.Read
  • offline_access
  • User.ReadBasic.All

My test user is in AAD Directory B (and without any special setting that only admins can consent to an application). When I try to login to my application this is the result:

enter image description here

The scope "User.ReadBasic.All" doesn't require a Admin consent, but somehow when I remove this requested scope the user can just login to the application without any admin consent.

Question is: Why does the admin consent show up with the "User.ReadBasic.All" scope?

The target would be, that a "normal" user can login to our application without hasseling with a tenant wide approval from the administrators. Does the "require admin consent" differ for "Multitenant" applications?

microsoft-graph-api azure-active-directory
4 Answers

Yes, as @Sruthi J said, when you select the Do not allow user consent tab in the Consent and permissions, all applications must require the administrator’s consent. Try to select the Allow user consent for apps tab to solve your problem.

1.Sign in to the Azure portal as a Global Administrator.

2.Select Azure Active Directory > Enterprise applications > Consent and permissions > User consent settings.

3.Under User consent for applications, select which consent setting you'd like to configure for all users.

4.Select Save to save your settings.

enter image description here

please see:here.

user_133366830

I have experienced a similar issue and found that it was because user assignment was required. Check your Enterprise Application under properties and select Assignment Required = No.

enter image description here

MS documents it here

Another scenario in which this error might occur is when the user assignment is required for the application, but no administrator consent was provided. In this case, the administrator must first provide administrator consent.

user_70309370

It is possible user consent is disallowed because of risk-based step-up consent.

You can confirm if this is the case by looking in the audit log (in "AAD Directory B"): Azure portal > Azure AD > Audit logs (under the "Monitoring" category).

When user consent is disallowed due to risk-based protection, a failed "Consent to application" event is emitted under the "ApplicationManagement" category, indicating it failed due to risk-based detections.

user_3256970

In Multi-tenant scenarios

If this is the first time a user from another tenant is logging in, and your app requires permissions that need administrator consent, the first user who signs in must be an admin.

You should have some kind of onboarding flow in which you include prompt=admin_consent in the authorize URL as above. Though this time you would use common instead of a tenant id/domain:

https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=id&redirect_uri=https%3A%2F%2Flocalhost%3A44307%2F&prompt=admin_consent

Please refer to this document

user_129767040
Related