The user or administrator has not consented to use the application - Send an interactive authorization request for this user and resource

Question

We're doing this CRM Web API project. The project logs-into Dynamics CRM online instance and gets the list of accounts.

The login seems to be happening fine. However, the accounts listing is giving the below error:

AADSTS65001: The user or administrator has not consented to use the application with ID 'xxxx-xxxxx-xxxx-xxx'. Send an interactive authorization request for this user and resource. Trace ID: e3b360d6-39fb-4e61-87d9-26531f30fd7b Correlation ID: 9b2cff0c-074e-44fe-a169-77c8061a7312 Timestamp: 2016-10-18 10:12:49Z

The permissions are properly set:

What is the problem?

Answer 1

An admin must consent to the permissions. You should make an authorization request to Azure AD that includes the parameter prompt=admin_consent.

As in the documentation here, the prompt parameter can have 3 values: login, consent, or admin_consent.

So, you should go to a URL such as https://login.microsoftonline.com/tenant-id/oauth2/authorize?client_id=app-client-id&redirect_uri=encoded-reply-url&response_type=code&prompt=admin_consent.

Replace tenant-id with your Azure AD tenant id/domain name, or common if your app is multi-tenant. Replace app-client-id with your app's client id. Replace encoded-reply-url with a URL-encoded reply URL of your app.

An easier way of constructing the URL you need is to go through authentication and just grab the URL in the address bar when you hit Azure AD. Then just add &prompt=admin_consent to the URL.

EDIT: With the newest update to the Azure Portal came the ability to grant permissions from the portal directly.

If you go to Azure Active Directory in the new portal, find your app registration there and click Grant Permissions under the Required permissions blade.