How Can i remove the admin consent popup for users who are not global admin, When users perform SSO admin consent popup appears which i don't want

Question

How Can i remove the admin consent popup for users who are not global admin, When users perform SSO admin consent popup appears which i don't want

Charles Kiss 20

Team I have setup sso on WP site using OAuth OIDC Plugin with MS ENtra ID, and want the suers to perform SSO with accepting the admin cionsent, I have added permission where Admoin consent is not required, see Email, Openid and Profile just 3 permission still my other users getting popup for admin consent approval, Can we remove this or is this a mandatory popup that needs to eb accepted by Global admin people???

Charles Kiss 20 Reputation points

2025-03-14T17:46:56.3133333+00:00

By the Thanks so much for your insights, However I have already done all the steps which you have mentioned still I get the admin consent and i ma figuring out how we can remove the admin consent popup let me share the screenshot for API permission

I would really appreciate if you or anyone can help me to remove the admin consent screens for users
Raja Pothuraju 23,800 Reputation points Microsoft External Staff Moderator

2025-03-14T19:40:40.34+00:00

Hello @Charles Kiss,

Thank you for your response.

Even after granting admin consent, if your users still see the consent prompt, it is likely because the OAuth request includes the prompt=consent parameter. This forces the consent screen to appear every time users log in.

Microsoft identity platform and OAuth 2.0 implicit grant flow

Please review your OAuth request and ensure that the prompt=consent parameter is removed from the URL or request. Removing it will prevent users from being prompted for consent repeatedly.

For more details, I recommend checking the following blog post, specifically the section on "Cause 1":

“Need admin approval” or “Approval required” AADSTS90094 error during Microsoft sign in

If the prompt=consent parameter is not present in your request and users are still seeing the consent prompt every time they log in, please let me know. We can connect offline via Teams to investigate further.
Charles Kiss 20 Reputation points

2025-03-15T17:35:53.78+00:00

I have checked the steps and we don;t get the prompt=admin consent any thing, I checked when i enter the site clicked on SSO button still doesn't see any prompt admin consent. Is there anyway we can have a quick call so that you can also review the settings, let me know it it works for you.
Raja Pothuraju 23,800 Reputation points Microsoft External Staff Moderator

2025-03-16T21:07:15.7766667+00:00

Hello @Charles Kiss,

Thank you for your response.

Yes, we have a look at it offline. Please share your contact details via private message.
Charles Kiss 20 Reputation points

2025-03-17T10:03:37.66+00:00

I updated the Authorization end point: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?prompt=none when I perfrom SSO got this error : Error from Authorize Endpoint: Session information is not sufficient for single-sign-on.
Raja Pothuraju 23,800 Reputation points Microsoft External Staff Moderator

2025-03-17T22:17:22.7733333+00:00

Hello @Charles Kiss,

We can take this troubleshooting offline. Please share your contact details via private message.
Raja Pothuraju 23,800 Reputation points Microsoft External Staff Moderator

2025-03-18T21:42:10.3566667+00:00

Hello @Charles Kiss,

I just wanted to check if you'd be interested in taking this offline to get this resolved. Please feel free to email me at AzCommunity@microsoft.com with the subject line "Attn: Pothurajur" and include a link to this thread for reference.
Raja Pothuraju 23,800 Reputation points Microsoft External Staff Moderator

2025-03-19T23:12:02.4066667+00:00

Hello @Charles Kiss,

I just wanted to check if you'd be interested in taking this offline to get this resolved. Please feel free to email me at AzCommunity@microsoft.com with the subject line "Attn: Pothurajur" and include a link to this thread for reference.

Accepted answer

0 additional answers

Your answer

Charles Kiss 20 Reputation points

2025-03-14T17:46:56.3133333+00:00

By the Thanks so much for your insights, However I have already done all the steps which you have mentioned still I get the admin consent and i ma figuring out how we can remove the admin consent popup let me share the screenshot for API permission

I would really appreciate if you or anyone can help me to remove the admin consent screens for users
Raja Pothuraju 23,800 Reputation points Microsoft External Staff Moderator

2025-03-14T19:40:40.34+00:00

Hello @Charles Kiss,

Thank you for your response.

Even after granting admin consent, if your users still see the consent prompt, it is likely because the OAuth request includes the prompt=consent parameter. This forces the consent screen to appear every time users log in.

Microsoft identity platform and OAuth 2.0 implicit grant flow

Please review your OAuth request and ensure that the prompt=consent parameter is removed from the URL or request. Removing it will prevent users from being prompted for consent repeatedly.

For more details, I recommend checking the following blog post, specifically the section on "Cause 1":

“Need admin approval” or “Approval required” AADSTS90094 error during Microsoft sign in

If the prompt=consent parameter is not present in your request and users are still seeing the consent prompt every time they log in, please let me know. We can connect offline via Teams to investigate further.
Charles Kiss 20 Reputation points

2025-03-15T17:35:53.78+00:00

I have checked the steps and we don;t get the prompt=admin consent any thing, I checked when i enter the site clicked on SSO button still doesn't see any prompt admin consent. Is there anyway we can have a quick call so that you can also review the settings, let me know it it works for you.
Raja Pothuraju 23,800 Reputation points Microsoft External Staff Moderator

2025-03-16T21:07:15.7766667+00:00

Hello @Charles Kiss,

Thank you for your response.

Yes, we have a look at it offline. Please share your contact details via private message.
Charles Kiss 20 Reputation points

2025-03-17T10:03:37.66+00:00

I updated the Authorization end point: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?prompt=none when I perfrom SSO got this error : Error from Authorize Endpoint: Session information is not sufficient for single-sign-on.
Raja Pothuraju 23,800 Reputation points Microsoft External Staff Moderator

2025-03-17T22:17:22.7733333+00:00

Hello @Charles Kiss,

We can take this troubleshooting offline. Please share your contact details via private message.
Raja Pothuraju 23,800 Reputation points Microsoft External Staff Moderator

2025-03-18T21:42:10.3566667+00:00

Hello @Charles Kiss,

I just wanted to check if you'd be interested in taking this offline to get this resolved. Please feel free to email me at AzCommunity@microsoft.com with the subject line "Attn: Pothurajur" and include a link to this thread for reference.
Raja Pothuraju 23,800 Reputation points Microsoft External Staff Moderator

2025-03-19T23:12:02.4066667+00:00

Hello @Charles Kiss,

I just wanted to check if you'd be interested in taking this offline to get this resolved. Please feel free to email me at AzCommunity@microsoft.com with the subject line "Attn: Pothurajur" and include a link to this thread for reference.

Answer 1

Raja Pothuraju 23,800 Microsoft External Staff Moderator

Hello @Charles Kiss,

Based on your description, I understand that you have registered an application in App Registrations and added Email, OpenID, Profile API permissions. These permissions show "Admin consent not required" when added through the portal. Please refer to the screenshot below to confirm that I am on the same page.

User's image It appears that when users access the application, they are prompted with a consent screen asking them to accept the permissions. Please see the screenshot below.

I tested obtaining an ID token using the email, openid, and profile scopes in the request:

https://login.microsoftonline.com/xxxxxxxx-9e9b-4da0-xxxx-cf13bbfxxxx/oauth2/v2.0/authorize?client_id=xxxxxxx-1f81-xxxx-9161-xxxxxxxx&nonce=defaultNonce&redirect_uri=https%3A%2F%2Fjwt.ms&scope=email+openid+profile&response_type=id_token

User's image

In this scenario, this behavior is expected the first time a user accesses the application because a global admin has not yet granted consent to these APIs or scopes.

Why do these APIs show "Admin consent required: No," and what is the difference between "No" and "Yes" in admin consent requirements?

If an API has "Admin consent required: No," users in your tenant can self-consent to these APIs by clicking "Accept" on the consent screen when they log in for the first time. After accepting, they will not see the consent prompt again for subsequent logins.

If an API has "Admin consent required: Yes," users cannot consent on their own. Only an admin can grant consent to the application. If the admin has not granted consent, users will see a prompt stating that Need admin approval.

User's image

To prevent users from seeing the admin consent screen when accessing the application for the first time, you need to grant admin consent to the APIs. You can do this by clicking "Grant admin consent for [Your Organization]" in the API permissions section of the application. See the screenshot below for reference.

User's image

Once admin consent is granted, users will no longer see the consent prompt when they log in.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Charles Kiss 20 Reputation points

2025-03-25T02:17:33.3433333+00:00

Hi Raja,

Thank you so much for your patience, and your attention to this inquiry. You have answered my question and your service is greatly appreciated and will be very helpful.

I would like to ask another question on this topic, however.

If I work in Company A, and the Entra ID Global Administrator for Company B is not readily available to approve my OAuth SSO application, is there another way to have my SSO application approved globally — for all users in the Company B tenant?

For example — a hypothetical example — are there Entra ID administrators, who can be created with privileges sufficient to register the Company A Client ID into the Company B Entra ID tenant directly, ie., to work around the Global Administrator consent popup?

I thought there was some "whitelist" of applications where a Company B admin with special privileges can simply add us (Company A Client ID), and that thereafter, all OAuth SSO attempts will be approved without an initial Global Admin consent popup.

The problem is the availability of the Global Admin of Company B, who is not to be bothered with this sort of task, apparently. Although, we can insist upon it, if it is required for a more secure or effective workflow.
Raja Pothuraju 23,800 Reputation points Microsoft External Staff Moderator

2025-03-25T11:37:19.97+00:00
Hello @Charles Kiss,

Thank you for your response.

Unfortunately, there is no option to approve the consent prompt for all users in Company B's tenant without the approval of its Global Administrator. If the admin does not approve the consent, each user will be required to approve it individually when they first access the application.

Administrators or users from other tenants cannot grant consent via the Azure portal—it must be done when:

A user or administrator first accesses the multi-tenant application:

If a user grants consent, each user will still see the consent prompt individually.

If a tenant administrator grants consent, no other users in the tenant will see the consent prompt again.

By sharing an Admin Consent URL with the administrators of Company B:

The Admin Consent URL allows administrators to grant tenant-wide admin consent without requiring individual user approvals.

Below is an example of an Admin Consent URL:

https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=6731de76-14a6-49ae-97bc-6eba6914391e&scope=https://graph.microsoft.com/Calendars.Read https://graph.microsoft.com/Mail.Send&redirect_uri=http://localhost/myapp/permissions&state=12345

To approve the app for all users in Company B, an administrator after service principal of the application getting created into the company B tenant must:

Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.

Browse to Identity > Applications > Enterprise applications > All applications.

Enter the name of the existing application in the search box, and then select the application from the search results.

Select Permissions under Security.

Note: Consent through the Azure Portal UI is only possible if at least one Company B user has already granted consent to the application.

Grant Admin Consent in Microsoft Entra ID

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Share via

How Can i remove the admin consent popup for users who are not global admin, When users perform SSO admin consent popup appears which i don't want

0 additional answers

Your answer