Why Do Office 365 Users Need Admin Consent Despite "Admin Consent Not Required" Setting in Azure AD?

Question

An application registered in Azure AD uses Microsoft Graph API with the following permissions:

1. Mail.Read
2. User.Read
3. offline_access

In the Azure portal, these permissions are marked as "Admin consent: Not required." However, when testing with some Office 365 organizational accounts, users are still getting prompted for admin consent.

Why?

Answer 1

Yes, organization administrators can configure Azure AD to require admin consent even for permissions that Microsoft marks as "Admin consent: Not required" by default. This can be done by changing the default user consent policy for the tenant. If the policy is set to "Do not allow user consent," all permissions will require admin consent regardless of their default status.

Additionally, administrators can allow user consent for apps from verified publishers or for selected permissions, which can also affect how permissions are handled within the organization.

---

References:

• Requesting permissions through consent
• Admin consent experience

Answer 2

You might run into this if the application is configured to require user assignment. See the big purple note here: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent?pivots=portal

You can toggle this under Properties > Assignment required? for the corresponding service principal.