Search code examples
azureauthenticationazure-active-directorymicrosoft-entra-id

Azure Entra ID Authentication Requiring Admin Consent

I have a web app service for which I am trying to configure Azure Entra ID authentication. The issue I'm having is I am able to log in, but other users are not. They continually receive "Admin consent is required for the permissions requested by this application. An admin consent request may be sent to the admin." However, none of the permissions set require admin consent.

I have the ability to create application registrations in Entra ID, and I've recreated the app registration several times. However, I do not have specific permissions to change the enterprise app settings.

These first screenshots are of the app registration authentication settings.

App Registration Authentication App Registration Authentication

Next are the assigned API permissions enter image description here

That is it as far as the app registration is concerned.

As for the authentication settings for the app service, they are shown here enter image description here

I've searched and read through a number of similar questions here on SO, such as Azure AD admin consent required when it shouldn't and Azure AD authentication access without admin consent to application. The answers to these questions do not help. As you can see, I don't have permission/authorization to provide admin consent for the organization. enter image description here

The same is true for the enterprise application. All settings are disabled for the application in the Self-Service blade.

enter image description here

And I do not have any permissions that require admin consent.

enter image description here enter image description here

In adding the app registration, I've followed Configure your App Service or Azure Functions app to use Microsoft Entra sign-in as well as Quickstart: Register an application with the Microsoft identity platform.

Is there a way to solve this, or do I have to go back to my Entra admins and ask them to change something?

Solution

  • Created a Microsoft Entra ID application and added API permissions like below:

    enter image description here

    Created Web app added authentication as Microsoft, selected the above Microsoft Entra application:

    enter image description here

    For sample, I used the below endpoint to authorize the users:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://rukweb.azurewebsites.net/.auth/login/aad/callback
&response_mode=query
&scope=https://graph.microsoft.com/.default
&state=12345

    Got the same error as below:

    enter image description here

    The error usually occurs if the API permissions granted to the Microsoft Entra ID is not granted admin consent or the user consent is not enabled in the tenant.

    In your scenario, as you do not want to grant the admin consent, you can contact the Global Admin to set the changes in Enterprise applications blade like below:

    Go to Azure Portal -> Enterprise application -> Consent and permissions -> User consent settings -> Enable the option Allow user consent for apps -> Save

    enter image description here

    Otherwise, you can enable "Allow user consent for apps from verified publishers, for selected permissions option":

    enter image description here

    And for the above option to work, you need to add user.read API permission in the permission classifications blade:

    enter image description here

    Now I am able to sign in successfully like below:

    enter image description here

    enter image description here