Multi-Tenant Teams App requires admin approval in tenant 2 but not tenant 1.

Question

I have developed a multi-tenant Microsoft Teams tab app that is registered in Tenant 1 (where it was initially created). Interestingly, the app doesn't require admin approval in Tenant 1, but it does require admin approval when deployed to Tenant 2. I'm trying to figure out why this is happening, as I need to distribute this app across multiple tenants without requiring admin approval each time.

The app was registered using a multi-tenant Azure AD app registration. I have registered a verified domain and updated all references in my code from '/(my domain ID)' to '/common'.

The permission scopes I'm using are:

"User.Read",

"AppCatalog.Read.All",

"User.ReadBasic.All",

"Calendars.ReadWrite",

"OnlineMeetings.ReadWrite",

"People.Read".

In Tenant 2, I have ensured that the setting 'All users can consent for any app to access the organisation's data' is enabled.

Despite these settings, the app still requires admin approval when deployed to Tenant 2. Am I missing something in my configuration? Are there other factors that could cause the app to require admin approval in Tenant 2 but not in Tenant 1? Any suggestions to resolve this issue would be greatly appreciated.

Answer 1

The issue was that I needed to add a verified publisher MPN id to the Azure AD multi-tenant app registration. I still haven't done this yet as I'm having some issued with separate domain tenants but I have been informed this is what was causing the admin consent issue.

Answer 2

@Daniel O'Sullivan - Could you please verify the following scenarios:

1. Check if your app requires any custom permissions that might not be covered by the 'All users can consent' setting. Some permissions might still require admin approval, even with this setting enabled."
2. "Even with the 'All users can consent' setting enabled, specific organization policies might still prevent certain permissions from being granted without admin approval. Please verify if Tenant 2 has any additional policies in place."
3. "Could you please test the app's behavior using different user accounts in both Tenant 1 and Tenant 2? Sometimes, differences in user roles can affect how permissions and consent are requested."

Thanks,
Nivedipa

---

If the response is helpful, please click "Accept Answer" and upvote it. You can share your feedback via Microsoft Teams Developer Feedback link. Click here to escalate.