Share via

Issues with Entra ID User Assignment for Application Access

Gvidas Bernotas 20 Reputation points
2025-03-06T16:14:31.1166667+00:00

A single tenant application was set up in Entra about a year ago, with the "User assignment required?" flag set to YES. Previously, users were redirected to Entra and received an error message indicating they were not assigned to the application. However, the current behavior allows users to access the app and receive an access token that lacks a roles claim.

I also see this behavior in a new application with no users assigned at all.

Has there been a change in default settings, and what steps can be taken to revert to the previous behavior?

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments
Accepted answer
  1. Navya 20,180 Reputation points Microsoft External Staff Moderator
    2025-03-07T06:14:31.5+00:00

    Hi @Gvidas Bernotas

    Thank you for posting this in Microsoft Q&A.

    Could you please check which roles the user holds by reviewing the assigned roles on the user’s page in Microsoft Entra ID? If the user has the Global Administrator (GA) role, they will be able to access the application even though the "User assignment required?" flag is set to YES.

    This behavior is by design to handle scenarios where:

    • The list of assigned users is removed, preventing the app from becoming orphaned.
    • After the app is initially provisioned, administrators need to assign users or app owners.

    Since Global Administrators have full control over Entra ID, they can bypass the user assignment restriction and access the application. If you want to strictly enforce access control, you may need to implement custom authorization rules within your application to validate user roles and claims.

    For more details, you can refer to the following documentation:

    Microsoft Entra built-in roles

    Secure applications and APIs by validating claims

    Hope this helps. Do let us know if you any further queries.

    If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vasil Michev 119.8K Reputation points MVP Volunteer Moderator
    2025-03-06T16:56:49.8966667+00:00

    I believe this depends on the type of permissions configured for the app. For delegate permissions, if assignment is required and the user is not in the scope, they should get an error when requesting token. If application permissions are used however, "empty" token with no roles will be returned. This is detailed for example here: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/what-is-access-management#requiring-user-assignment-for-an-app

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.