"Need admin approval" although the option is set to "Allow user consent for apps"

Question

"Need admin approval" although the option is set to "Allow user consent for apps"

Wolfram Müller 21

Hi there,

we are developing an app that lets users connect their mailboxes. We get an access token via https://login.microsoftonline.com/organizations.

A few customers have complained about the "need admin approval" error, and we were able to confirm that it disappears when you mark the option "Allow user consent for apps" (In: Directory > Enterprise applications > Consent and permissions > User consent settings.)

For one customer though, the message persists: even though the setting is set to "Allow user consent for apps" they still receive the "need admin approval" error.

Is there some other setting they have to look for, to make the message go away? What else could trigger this?

Thanks in advance!

Accepted answer

0 additional answers

Your answer

Answer 1

Vasil Michev 117.1K MVP

They need to check the settings therein, as the specific scope(s) you are requesting might not all be allowed for users to consent to. In addition, the app might be triggering the step-up/risk flow, as detailed here: https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/configure-risk-based-step-up-consent

Wolfram Müller 21 Reputation points

2022-12-07T07:40:03.337+00:00

Hey @Vasil Michev ,

thank you so much for your response, that was very helpful!

I have two follow up questions:

1) We are requesting 3 scopes: offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send
Is that different for every organization if those scopes are allowed for users to consent to? Is that a setting? Where do users find that setting in the azure portal?

2) Our app is fairly new and still unverified. Could that be the reason? There are three options in user consent settings. One is 'Allow consent for apps for verified publishers' and another is 'Allow user consent for apps'. The customer in question had the last option selected, so we thought it would allow unverified apps. But you're saying, since we are unverified it could have classified our app as risky and triggered the need admin approval Just confirming if I understood it correctly

Thanks in advance,
Wolfram.
Vasil Michev 117.1K Reputation points MVP

2022-12-07T09:01:26.217+00:00

Start with verifying your app, this is a requirement now as per the link I posted above. If the app is unverified, it will trigger the consent flow regardless of the tenant settings.
Follow the process here: https://learn.microsoft.com/en-us/azure/active-directory/develop/publisher-verification-overview

Share via

"Need admin approval" although the option is set to "Allow user consent for apps"

0 additional answers

Your answer