Add API permission for an app under Enterprise App in Entra ID

Question

Hi all,

There is an enterprise app and I was asked to grant the following permission Microsoft Graph: API permissions → addMail.ReadWrite (delegated, Microsoft Graph) → grant admin consent for the tenant.

The app in question is under Enterprise Apps and there is no API Permission section and no button Add Permission.

I can only see API Permission section and Add Permission button under registered apps under App Registration.

Does that mean permissions cannot be added under enterprise applications?

Thank you.

Answer 1

Yes. In Microsoft Entra ID, adding API permissions is done on the App registration, not on the Enterprise application.

The Enterprise applications pane is used to review existing permissions and grant tenant-wide admin consent for an app that is already provisioned in the tenant. It does not provide the Add a permission action.

For the scenario described:

1. Go to Entra ID > App registrations > All applications.
2. Select the application registration for that app.
3. Open API permissions.
4. Select Add a permission > Microsoft Graph.
5. Choose Delegated permissions.
6. Add Mail.ReadWrite.
7. Then select Grant admin consent.

If the app already exists in Enterprise applications, tenant-wide admin consent can also be granted there:

1. Go to Entra ID > Enterprise apps > All applications.
2. Select the app.
3. Open Security > Permissions.
4. Review the requested permissions.
5. Select Grant admin consent.

Important detail: the permission must first be part of the app’s requested permissions. The Enterprise applications blade is for consent/review, while the App registrations blade is where permissions are added.

---

• Grant tenant-wide admin consent to an application (portal)
• Update an app's requested permissions in Microsoft Entra ID (portal)
• Configure app permissions for a web API