Azure AD app Need admin approval error: App needs permission to access resources in your organization that only an admin can grant

user_4746457 0
Viewed 11369

We have an Azure AD app used for authenticating to APIs. We use permissions like offline_access, openid, profile, User.Read etc. and have granted admin consent already. This has been working since 1 year without any issues. In this week, we received 4-5 external users complaining about the error:

Need admin approval

App needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.

  1. It is not related to a particular external user from a particular organization, some other user from the same organization don't get this error.

  2. This error occurs only for new external users, we haven't yet received any issues from existing external users.

  3. Admin granted admin consent again after reported error but the users still get the same error message.

I went through few other questions with same error. But since the configuration has been working since past year I am bit confused. During this period we have had lot of external users without any issue.

What configuration should I check to resolve this? Or is there any update in Azure AD default settings?

azure-active-directory azure
1 Answers

  • Check if the Allow users to consent to apps accessing company data on their behalf is set to No in Enterprise Application Users settings.

    If it set to No then please toggle it to yes . This option lets users decide by themselves if they want to grant access to a given app to everyone in their organization.

From Microsoft’s official documentation: If this option is set to yes, then users may consent to allow applications which are not published by Microsoft to access your organization’s data, if the user also has access to the data. This also means that the users will see these apps on their Access Panels. If this option is set to no, then admins must consent to these applications before users may use them.

  • Check if the Allow users to request admin consent to apps they are unable to consent to is set to No.

    If it is set to No then toggle it to yes as well. If your organization decides that users indeed must have explicit approval, this option makes it easy for those users to request approval.

    To enable this option, click on User settings (same as in the previous stem) and then toggle Admin consent requests to “Yes”. Make sure to Save your changes, which may take a few minutes to propagate.

From Microsoft Documentation: If this option is set to yes, then users request admin consent to any app that requires access to data they do not have the permission to grant. If this option is
set to no, then users must contact their admin to request to consent
in order to use the apps they need.

enter image description here

Note : If this Setting is done from your APP tenant , Please also check the external users tenant as this needs to be done from their side as well as while trying to use the app, your app will retrieve user profile etc. from the users tenant .

  • Add Priority Matrix as an Enterprise Application (org-wide)

    if your AAD administrator decides that everyone in your organization should get access to Priority Matrix, they can follow these steps:

    From the “Enterprise Applications” view, click on All Applications

    Select + New Application to set up Priority Matrix with Azure AD authentication

    Search “Priority Matrix” and proceed to configure the app with AD authentication

enter image description here

Note: If you still face the issue please reach out to Azure support engineer to get assisted support by clicking on (Help+support) and creating a technical support request as it may need live troubleshooting.

user_159692990
Related