Msal-Angular v1 - acquireTokenPopup/LoginPopup returns an Access Token with Insufficient Privileges even after granting admin consent

Question

We are receiving an invalid accessToken with empty scopes on the first grant of admin consent. If the user retries again - we call the acquireTokenPopup and the accessToken becomes valid.

Reproduction Steps

Step 1: Admin clicks the log in button (loginPopup)

Step 2: MS prompts login and admin consent page (We need User.Read.All)

Step 3: We call acquireTokenSilent() to acquire for Access Token as the AuthenticationProvider of our Graph Client

Step 4: Graph API /users request returns 403 - insufficient permission

Core Library: @azure/msal or msal

Core Library Version: 1.4.8

Wrapper Library: @azure/msal-angular

Wrapper Library Version: 1.1.2

Angular: 7

I've created a GitHub Issue ticket here: https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/3524

Answer 1

When you add permissions to the application, you must grant the tenant-wide administrator consent for the application. However, there will be a short delay whether it is granting the administrator consent in the Azure portal or using the administrator consent URL.

If you request an access token immediately after obtaining the administrator’s consent, it may cause the token to lack permissions. In this case, you only need to refresh, and then try to obtain the token again.

In addition, you must ensure that the token is obtained after the administrator consent, otherwise the original token will still not contain the new permissions.