Corporate account apps registration error: AADSTS90094

Question

Corporate account apps registration error: AADSTS90094

YanC 60

Hi guys,

I am using Microsoft365 Corporate account, trying to read/write onedrive documents with the client ID and secret. I am sure all entries are correct and it shows below error message:

Need admin approval

{apps name}

unverified

{apps name} needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.

Do anyone know which consent should I get from the IT admin?
I searched online but still confused about the solution, cuz most of the sections show "You don't have access". How could I grant for consent?

Many Thanks!

Answer accepted by question author and recommended by moderator

3 additional answers

Your answer

Answer 1

Sophie N 13,235 Microsoft External Staff Moderator

Dear @YanC,

Thank you for posting your question in the Microsoft Q&A forum. The error AADSTS90094: Need admin approval occurs because the application requires permissions that only an administrator can grant.

Official guide: Unexpected error when performing consent to an application - Microsoft Entra ID | Microsoft Learn

Your app requests permissions (such as Microsoft Graph or OneDrive access) that need admin consent. Non-admin users cannot approve these permissions.

Please ask your IT administrator to:

Sign in as a Global Administrator in Microsoft Entra admin center.
Navigate to: Identity > Applications > Enterprise applications > [Your App] > Permissions
Click Grant admin consent for (Organization Name) to approve the requested permissions.

For more details, please refer to Microsoft’s official documentation: Grant tenant-wide admin consent to an application - Microsoft Entra ID | Microsoft Learn

Optional

Enable Admin consent workflow so users can request approval directly from the consent screen: Configure how users consent to applications - Microsoft Entra ID | Microsoft Learn

Once admin consent is granted, the app should work without further approval prompts. If issues persist, confirm that all required permissions are granted and no new scopes were added after consent.

If you need help finding your admin, please see: How do I find my Microsoft 365 admin? - Microsoft Support

Please let me know if you have any further questions or if the problem persists after trying these solutions. Thank you for your patience and cooperation.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

YanC 60 Reputation points

2025-11-27T08:16:21.03+00:00

Dear Sophie,

Thanks for quick response and the detailed procedures.

IT admin has already grant me the admin for the specific application, here attached the capture photo for double confirmation. However, it still shows the same error message. Could you please help to fix this?
Sophie N 13,235 Reputation points Microsoft External Staff Moderator

2025-11-28T03:31:26.1866667+00:00
Dear @YanC,

Thank you for your update and for sharing the screenshot confirming that admin consent was granted.

Please note that after granting admin consent, changes may take some time to propagate across Microsoft services. We recommend waiting 24–36 hours and then testing again.

If the issue persists after this period, please try the following:

Revoke and Re-Grant Permissions
Sometimes the initial grant does not sync correctly. Ask your IT admin to remove the consent and then grant it again for the application.
For more details, please refer to Microsoft’s official documentation Review permissions granted to enterprise applications - Microsoft Entra ID | Microsoft Learn

Verify Permissions for the Correct Application
Ensure that the permissions were granted for the exact app you are using. For example, if you are working with Microsoft Graph, this app is widely used and often does not require repeated consent requests.
For more details, please refer to Microsoft’s official documentation Update an app's requested permissions in Microsoft Entra ID - Microsoft identity platform

Confirm User Assignment
Check that your account is properly assigned to the application in Enterprise Applications under Users and Groups.

If after these steps the error still appears, please share the exact error message and any recent changes made by your IT admin so we can assist further.

We appreciate your patience and will continue to support you until this is resolved.

Learn how to review and revoke permissions, and invalidate refresh tokens for an application in Microsoft Entra ID.
Sophie N 13,235 Reputation points Microsoft External Staff Moderator

2025-11-30T23:51:42.5866667+00:00

Dear @YanC,

I hope you’re doing well. I just wanted to check in and see how things are going with the steps I shared earlier. If you ran into any difficulties at any point or if something is unclear, please don’t hesitate to let me know. I completely understand that these processes can sometimes be tricky, and I’m here to make it as easy as possible for you.

Feel free to share any details or questions you might have, I’m ready to listen and assist you further.
YanC 60 Reputation points

2025-12-01T02:27:34.7766667+00:00

Hi Sophia,

Thanks for the follow up.

After waiting for 24 hours, we still could not connect to the OneDrive with granting the correct application, but it could connect to the excel with the same client ID & Secret.

Furthermore, I am considering whether we grant the right permission for reading files on OneDrive. Could you please advise are there any reading permissions that corporate account required?

Here are the API permissions that we have tried, should the rest (Files.ReadWrite.All , offline_access, etc) also grant for the admin permissions?
Sophie N 13,235 Reputation points Microsoft External Staff Moderator

2025-12-01T04:27:24.6533333+00:00
Dear @YanC,

Thank you for your follow-up. I’ve reviewed your questions and the permissions you listed. Here are the answers:

Why can the app connect to Excel but not OneDrive?

Excel and OneDrive use different Microsoft Graph endpoints and permissions. While User.Read and delegated permissions allow basic profile and Excel access, OneDrive requires additional Files permissions and, in many cases, admin consent for corporate accounts.

Are the current permissions correct for reading files on OneDrive?

The permissions you listed (Files.ReadWrite.All, Files.ReadWrite.AppFolder, offline_access, User.Read) are Delegated. These work only when a signed-in user is present. For corporate or background apps (no user interaction), you need Application permissions, such as:

Files.Read.All (read all files user can access)

Files.ReadWrite.All (read/write all files user can access)

Reference: Microsoft Graph Files permissions

Should these permissions also have admin consent?

Yes. For corporate accounts, admin consent is required for both Delegated and Application permissions that access files. Steps:

Go to Azure Portal > App Registration > API Permissions

Click Grant admin consent for [Tenant Name]

Guide: Grant admin consent in Azure AD.

Additional recommendations

If your app runs without user sign-in, switch to client credentials flow and use Application permissions.

After adding permissions, ensure you request the correct scopes in your token request (Files.Read.All or Files.ReadWrite.All).

Verify the access token includes these scopes.

Summary: Add Application permissions for OneDrive, grant admin consent, and confirm the OAuth flow matches your scenario. This will resolve the inability to connect to OneDrive while Excel works.

For detailed guidance:

Understanding OneDrive API permission scopes - OneDrive dev center | Microsoft Learn

Microsoft Graph permissions reference - Microsoft Graph | Microsoft Learn

Please let us know if you need step-by-step instructions for adding these permissions or configuring the client credentials flow.
YanC 60 Reputation points

2025-12-01T06:24:42.2033333+00:00

Dear Sophia,

Thanks for the detailed explanation, I have asked for the permission for the items above and issue fixed.

Thank you so much and appreciate for the big helping hand.

Thumbs up=)
Sophie N 13,235 Reputation points Microsoft External Staff Moderator

2025-12-01T23:17:31.0266667+00:00

Dear @YanC,

Thank you for your efforts to resolve this issue. We truly appreciate your time and attention to this issue.

If you have any further questions or would like to add your comments, please share the new question form so that our community members can continue to assist you.

Answer 2

Owen Baern 0

I found this a lot more informative and helpful than what you've been given thus far... https://medium.com/@namsoochoi/solved-need-admin-approval-or-approval-required-aadsts90094-error-during-microsoft-sign-in-b3fde2ec4523

Answer 3

YanC 60

Dear Sophie,

Thanks for quick response and the detailed procedures.

IT admin has already grant me the admin for the specific application, here attached the capture photo for double confirmation. However, it still shows the same error message. Could you please help to fix this?
User's image

Sophie N 13,235 Reputation points Microsoft External Staff Moderator

2025-11-28T03:31:47.4733333+00:00
Dear @YanC,

Thank you for your update and for sharing the screenshot confirming that admin consent was granted.

Please note that after granting admin consent, changes may take some time to propagate across Microsoft services. We recommend waiting 24–36 hours and then testing again.

If the issue persists after this period, please try the following:

Revoke and Re-Grant Permissions Sometimes the initial grant does not sync correctly. Ask your IT admin to remove the consent and then grant it again for the application. For more details, please refer to Microsoft’s official documentation Review permissions granted to enterprise applications - Microsoft Entra ID | Microsoft Learn

Verify Permissions for the Correct Application Ensure that the permissions were granted for the exact app you are using. For example, if you are working with Microsoft Graph, this app is widely used and often does not require repeated consent requests. For more details, please refer to Microsoft’s official documentation Update an app's requested permissions in Microsoft Entra ID - Microsoft identity platform

Confirm User Assignment Check that your account is properly assigned to the application in Enterprise Applications under Users and Groups.

If after these steps the error still appears, please share the exact error message and any recent changes made by your IT admin so we can assist further.

We appreciate your patience and will continue to support you until this is resolved.

Learn how to review and revoke permissions, and invalidate refresh tokens for an application in Microsoft Entra ID.

Answer 4

To resolve the AADSTS90094 error, you need to obtain admin consent for the application you are trying to use. This error indicates that the application requires permissions to access resources in your organization that only an administrator can grant. Here are the steps you can follow:

Contact your IT Admin: You should reach out to your IT administrator and inform them about the specific permissions that the application needs. They will need to review the application and grant the necessary permissions on your behalf.
Admin Consent: The admin will need to provide tenant-wide admin consent for the application. This can typically be done through the Azure portal or Microsoft Entra admin center.
Check Application Registration: Ensure that the application is properly registered in Microsoft Entra ID and that it has the required permissions listed in its application registration.
Review User Consent Settings: If user consent is disabled at the tenant level, the admin will need to enable it or manage the consent workflow to allow users to request access.

Once the admin has granted the necessary permissions, you should be able to use the application without encountering this error again.

References:

Share via

Corporate account apps registration error: AADSTS90094

{apps name} needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.

3 additional answers

Your answer