Is it possible to allow user consent for enterprise applications which require assignment?

Question

I am developing an application for internal use within my company but to prevent any random employee from accessing it we want to require user assignment. Unfortunately this prevents users from individually consenting to the application, requiring org-wide administrative consent for all API permissions, including the OpenID connect permissions which normally do not require admin consent.

Per the documentation:

When an application requires assignment, user consent for that application isn't allowed. This is true even if users consent for that app would have otherwise been allowed. Be sure to grant tenant-wide admin consent to apps that require assignment.

Although the application only requires the openid, and profile permissions in order to function, our administrators are wary of granting tenant-wide consent for anything as there are potential security implications.

Is there any way to configure our Registered Application, Enterprise Application, or Entra security policies that would allow our users to still grant consent without requiring administrative approval, or is tenant-wide administrative approval mandatory?

Answer 1

The current behavior is a "known limitation", Microsoft is aware of the challenges it poses and is working on addressing it in the future. Until then, admins will have to grant consent, either for the desired users or tenant-wide.