Azure Active Directory multi-tenant common endpoint admin permission required.

Question

Hello, I created a new tenant for Azure Active Directory and then registered a web app. The supported accounts type for the app is Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox). When I go to sign in with a personal account on the /common/oauth2 endpoint, I am able to consent and sign in. However, when I go to sign in with the tenant's global admin account (which is also the account I used to register the app) on the common endpoint, I get a 'Need admin approval' error. But then, when I use the tenant specific authorization endpoint (eg /{my_tenant_id}/oauth2/...) instead of the common endpoint, I don't get this error and am able to sign in. I cannot use that endpoint though because then I won't be able to authorize personal Microsoft accounts. Shouldn't the global admin account for the tenant already be an admin and subsequently be able to sign in for the common endpoint? Why doesn't the common endpoint allow the tenant Microsoft account (the global admin account) to sign in?

Answer 1

Hello @Clay Casper

Thank you for your post on this community space.

I wonder if you followed the next steps shown down below:

Looking forward to your feedback,

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.