Application stuck in an Approval Required consent loop (AADSTS90095)

Question

Hi! One of our clients continuously gets stuck during authentication at an "Approval Required" screen. Here they fill in a justification and "Request Approval." The admin on their account approves the request, but when the user logs in again they see the same screen.

The admin has tried:

• granting admin consent for the application in the Permissions Entra screen
• granting tenant-wide admin consent using the following URL: https://login.microsoftonline.com/{organization}/adminconsent?client_id={client-id}
  • after logging in the admin checked the option to "Consent on behalf of your organization"
  • the admin was able to log in successfully, but users are not able to
• the admin has also tried "Allow user consent for apps"

For more context, most people get a AADSTS90094 error. We are seeing an AADSTS90095 error**.**

Our app is requesting the scopes: [offline_access openid email profile User.Read Mail.ReadWrite MailboxSettings.ReadWrite Mail.Send]

We are making the OAuth process via the URL https://login.microsoftonline.com/common/oauth2/v2.0/authorize?prompt=consent

We use ?prompt=select_account for account creation and prompt=consent for reauthentication

Can someone help us solve this authentication issue.

Answer 1

Is there any particular reason why you are adding the prompt=consent parameter to your authentication requests? This is what's most likely causing the behavior you are describing above. There is no need to ask for consent with each authentication request, moreover admin consent has been granted to the app, as you mentioned above.

Another thing to keep in mind is that if the application has been configured to require user assignment in the customer's tenant, this can also cause some "stuck" prompts. This behavior is detailed here: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent?pivots=portal

Applications that requires users to be assigned to the application must have their permissions consented by an administrator, even if the user consent policies for your directory would otherwise allow a user to consent on behalf of themselves.