Does a call to "https://login.microsoftonline.com/{tenant}/v2.0/adminconsent?client_id=

Question

Consider the have the following scenario:

• SaaS service uses a multi-tenant Azure AD app to access resources located in the M365 tenant of the service customers
• When onboarding a new account, the service explicitly request admin consent for our app (using variant of `https://login.microsoftonline.com/{customer_tenant_id}/v2.0/adminconsent?client_id=

Answer 1

Yes, querying the /adminconsent endpoint will always result in triggering the consent dialog. If you want to check the current consent state, obtain an access token and check the scopes/roles therein. Only then, if needed, trigger a request against the /adminconsent endpoint.
Refer to this article for more info: https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#validate-user-permission

Answer 2

Thank you @Vasil Michev . Your suggestion will work great!